Intel

CVE-2026-93387

Chromium CVE-2026-93387: Improper state validation in Skia

mediumEPSS 0.3%

Description

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Source: Debian Security AdvisoriesBSI WID PortalBSI CSAFMicrosoft Security Update GuideNVD (NIST)cvelistv5

Affected operating systems

  • linux

    debian / chromiumtrixie

Metrics

XIEM Effective CVSS
4.3
Source: cna-v3
EPSS percentile
15.6 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
53.44
Exploit maturity
no public PoC known
CVSS v3
4.3
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-30 20:25 UTC
CWE
CWE-754

Weakness classes (CWE)

  • CWE-754Class

    Improper Check for Unusual or Exceptional Conditions

    The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-09-18 17:17 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 153.0.8010.52
    • Reference Type: Chrome: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html Types: Release Notes, Vendor Advisory
    • Reference Type: Chrome: https://issues.chromium.org/issues/553130676 Types: Permissions Required
  2. CVE Modified2026-09-18 14:19 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    • SSVC: {"id":"CVE-2026-93387","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. New CVE Received2026-09-17 21:17 UTC· chrome-cve-admin@google.com
    • Description: Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
    • CWE: CWE-754
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93387.json">CVE-2026-93387</a>
    • Reference: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html