CVE-2026-84325: Google Chrome Auth Bypass Vulnerability

CVE-2026-84325 Overview

CVE-2026-84325 is an improper input validation vulnerability [CWE-20] in the DataTransfer component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.75. A remote attacker leveraging social engineering can bypass system access restrictions through a co-installed application. Google's Chromium team rated this issue as High security severity.

The vulnerability sits in the browser's clipboard and drag-and-drop data pipeline. Successful exploitation requires user interaction combined with a companion application already present on the target system. Attackers can chain these conditions to reach resources normally isolated from web content.

Critical Impact
Remote attackers can bypass Chrome's system access restrictions to interact with co-installed applications, expanding the browser's attack surface into the underlying operating system.

Affected Products

Google Chrome (Desktop) versions prior to 152.0.7977.75
Chromium-based browsers incorporating the vulnerable DataTransfer implementation
Systems with co-installed applications that trust Chrome-originated data

Discovery Timeline

2026-09-02 - CVE-2026-84325 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84325

Vulnerability Analysis

The vulnerability resides in Chrome's DataTransfer interface, which brokers data during clipboard operations and drag-and-drop events. Chrome fails to properly validate input passed through this interface. An attacker can craft web content that produces DataTransfer payloads capable of reaching system components that should remain out of reach for web origins.

Exploitation depends on a co-installed application registered to handle browser-originated data. When the victim performs a drag, drop, paste, or similar user action, the malformed payload flows to the co-installed app. That handoff bypasses the security boundary Chrome enforces between web content and the host operating system.

The attack requires social engineering to induce the necessary user gesture. However, the network attack vector and lack of authentication requirements make delivery straightforward through any attacker-controlled or compromised website.

Root Cause

The root cause is missing or insufficient validation on data leaving the DataTransfer object [CWE-20]. Chrome does not adequately constrain the content, format, or destination of transferred data. This allows web-controlled input to influence trusted application interfaces.

Attack Vector

An attacker hosts a malicious page and lures the victim into interacting with it. The page issues a DataTransfer operation targeting a co-installed app. The unvalidated payload then invokes application behavior that bypasses browser sandbox restrictions on system access. Refer to the Chromium Issue Tracker Entry for reproduction details.

No verified proof-of-concept code is publicly available. See the Google Chrome Stable Update for the vendor's release notes.

Detection Methods for CVE-2026-84325

Indicators of Compromise

Chrome browser processes spawning or communicating with co-installed helper applications immediately after user drag-drop or paste actions on untrusted sites
Unexpected inter-process communication between chrome.exe and vendor-specific companion apps following web navigation
Anomalous file writes or protocol handler invocations sourced from Chrome renderer processes

Detection Strategies

Inventory installed browsers and confirm Chrome build numbers against 152.0.7977.75 or later across the estate
Monitor endpoint telemetry for parent-child process relationships where Chrome launches co-installed applications with attacker-controlled arguments
Correlate browser navigation logs with subsequent local application execution to identify social-engineering-driven chains

Monitoring Recommendations

Ingest browser and endpoint process telemetry into a centralized data lake for cross-source correlation
Alert on registered custom protocol handlers being invoked from newly visited domains
Track user reports of unexpected application prompts triggered by web content

How to Mitigate CVE-2026-84325

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
Force browser restart after deployment to ensure the patched binary is loaded
Audit co-installed applications that register as DataTransfer or protocol handlers and remove those not required

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.75. Administrators should validate deployment through enterprise update mechanisms such as Google Update, Microsoft Intune, or Jamf. Details are available in the Google Chrome Stable Update announcement.

Workarounds

Deliver end-user guidance warning against drag-drop and paste interactions with untrusted sites until patches are applied
Restrict installation of co-installed browser companion applications through enterprise application allowlisting
Enforce Chrome enterprise policies that limit external protocol handler execution without explicit user confirmation

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify on Linux
google-chrome --version