CVE-2026-93377 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. It affects versions prior to 153.0.8010.52. Exploitation requires a remote attacker to trick a user into visiting a specially crafted HTML page, which can lead to arbitrary code execution inside the sandbox environment of the browser. The vulnerability was publicly disclosed and assigned a high severity rating by the Chromium security team. No CVSS score is provided in the available data. The vendor advisory URL points to a Chrome stable channel update announcement, indicating a fix was released.

Successful exploitation allows remote code execution within the sandboxed environment of Google Chrome, potentially enabling attackers to run arbitrary code on the victim's machine with the privileges of the browser process. This could lead to further exploitation depending on sandbox escape techniques, but the direct impact described is code execution inside the sandbox.

A fix is available in Google Chrome version 153.0.8010.52 and later. Users and administrators should update to this version or a later stable release to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html confirms the availability of the official fix.