CVE-2026-84323: Google Chrome FileSystem Information Disclosure

CVE-2026-84323 Overview

CVE-2026-84323 is a missing authorization vulnerability [CWE-862] in the FileSystem component of Google Chrome prior to version 152.0.7977.75. A remote attacker who has already compromised the renderer process can leverage social engineering to trick a user into interacting with a crafted HTML page. Successful exploitation allows the attacker to obtain sensitive information from the local file system. Google classified the Chromium security severity as Medium.

Critical Impact
Attackers can extract sensitive local file system data from victims running unpatched Chrome builds when the renderer process has been compromised and the user is manipulated via social engineering.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.75
Chromium-based browsers sharing the vulnerable FileSystem code path
Downstream distributions bundling pre-152.0.7977.75 Chromium builds

Discovery Timeline

2026-09-02 - CVE-2026-84323 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84323

Vulnerability Analysis

The flaw resides in Chrome's FileSystem implementation, where authorization checks are missing on operations that should be gated by user consent or origin controls. When an attacker has already compromised the renderer process, the missing authorization allows the attacker to interact with file system APIs beyond their intended sandbox boundaries. The vulnerability is classified under CWE-862: Missing Authorization, which covers cases where software does not perform an authorization check when an actor attempts to access a resource. Exploitation additionally requires user interaction driven by social engineering, which raises the attack complexity but does not eliminate the risk.

Root Cause

The root cause is an absent authorization check inside Chrome's FileSystem API surface. Operations that should verify the requesting origin, user gesture, or granted file handle permissions proceed without validation once the renderer is under attacker control. This design gap turns a compromised renderer into a pivot for exfiltrating sensitive data that the browser process would normally protect.

Attack Vector

The attack chain assumes the renderer process is already compromised, typically through a separate exploit or a malicious extension. The attacker then serves a crafted HTML page and uses social engineering to induce specific user interactions, such as clicking a prompt or approving a file access dialog. Once the user acts, the missing authorization check permits the renderer to reach file system resources and return their contents to attacker-controlled code. The vulnerability affects confidentiality only; integrity and availability are not impacted.

No public proof-of-concept exploit is listed in the referenced advisories. Technical details are available in the Chrome Release Update and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-84323

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes or reading files outside the browser profile directory
Outbound network requests from Chrome containing base64-encoded or raw file contents shortly after user interaction with untrusted pages
Browser telemetry showing FileSystem API calls originating from newly loaded or unfamiliar origins

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any host running a build older than 152.0.7977.75
Correlate browser process telemetry with file access events targeting user document, download, and credential store paths
Alert on renderer process behavior that deviates from established baselines, including anomalous IPC traffic to the browser process

Monitoring Recommendations

Ingest Chrome update status and installed version data into your SIEM or asset inventory for continuous compliance checks
Monitor endpoint EDR telemetry for Chrome renderer processes accessing sensitive files such as SSH keys, browser profiles, or configuration stores
Track user reports of unexpected file access prompts or social engineering lures referencing Chrome dialogs

How to Mitigate CVE-2026-84323

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all desktop platforms
Force a browser restart after patch deployment to ensure the fixed binaries are loaded
Audit installed browser extensions and remove any that are unnecessary or untrusted, as they expand the renderer attack surface

Patch Information

Google addressed CVE-2026-84323 in the Chrome Stable channel release documented in the Chrome Release Update. Administrators should confirm that managed Chrome installations have received the update by validating the version string is at least 152.0.7977.75. Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi should be updated once their vendors ship a merged fix.

Workarounds

Enforce Chrome auto-update policies through enterprise management tooling to reduce the window of exposure
Restrict use of the FileSystem Access API via the DefaultFileSystemReadGuardSetting and DefaultFileSystemWriteGuardSetting enterprise policies until patching completes
Deliver targeted user awareness communications about social engineering lures that request file access approvals from within the browser

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example enterprise policy fragment to block FileSystem Access API by default
# /etc/opt/chrome/policies/managed/filesystem_policy.json
{
  "DefaultFileSystemReadGuardSetting": 2,
  "DefaultFileSystemWriteGuardSetting": 2
}