CVE-2026-84328: Google Chrome Auth Bypass Vulnerability

CVE-2026-84328 Overview

CVE-2026-84328 is a missing authorization vulnerability [CWE-862] affecting the FileSystem component in Google Chrome prior to version 152.0.7977.75. The flaw allows a remote attacker who has already compromised the renderer process to bypass web origin policy through a crafted HTML page. Chromium engineers rated the security severity as Medium. The bug enables cross-origin data access from a compromised renderer, weakening the site isolation boundary that Chrome relies on to contain hostile web content.

Critical Impact
An attacker who controls a compromised renderer process can bypass same-origin restrictions in the FileSystem API and access resources belonging to other web origins.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.75
Chromium-based browsers that inherit the vulnerable FileSystem code path
Downstream Chromium redistributions that had not yet integrated the September 2026 stable channel update

Discovery Timeline

2026-09-02 - CVE-2026-84328 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84328

Vulnerability Analysis

The vulnerability resides in Chrome's FileSystem implementation, where an authorization check is missing before servicing certain requests. Chrome's security model depends on the browser process validating that a renderer only accesses resources belonging to its own web origin. When that check is absent, a renderer that an attacker has already subverted can request FileSystem operations that cross the origin boundary.

Exploitation is not a single-step remote compromise. The attacker must first gain code execution or equivalent control inside the renderer process, typically by chaining a prior renderer bug. From that position, the missing authorization allows the attacker to escape the same-origin policy for FileSystem-mediated data. User interaction is required to reach the vulnerable path via a crafted HTML page.

The impact is confidentiality-focused. An attacker can read data associated with origins other than the one the renderer is nominally hosting, but the flaw does not, on its own, grant integrity or availability impact outside the compromised process.

Root Cause

The root cause is a missing authorization check [CWE-862] in the FileSystem code path. The browser-side handler fails to verify that the calling renderer is authorized for the requested origin before performing the operation, breaking Chrome's origin isolation guarantees.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a crafted HTML page in a Chrome build prior to 152.0.7977.75, and the attacker must already have compromised the renderer process handling that page. Once both conditions are met, the attacker issues FileSystem requests that the browser process services without enforcing origin authorization. Refer to the Chromium Issue Tracker Entry and the Chrome Release Update for vendor technical details.

Detection Methods for CVE-2026-84328

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.75 after the September 2026 stable channel release
Renderer processes exhibiting anomalous FileSystem API access patterns spanning multiple web origins
Unexpected child process crashes or sandbox violations that precede suspicious cross-origin data access

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.75 as vulnerable
Monitor for renderer exploitation precursors, such as JIT crashes or type-confusion signatures, since this bug is only reachable from an already-compromised renderer
Correlate outbound network traffic from browser sessions with unusual visits to newly registered or low-reputation domains hosting crafted HTML

Monitoring Recommendations

Enable browser telemetry and forward crash and process-lifecycle events to a central analytics pipeline for review
Track Chrome update compliance in endpoint management tooling and alert on hosts that fall behind the current stable channel
Review DNS and web proxy logs for repeated visits to attacker-controlled pages coinciding with browser instability

How to Mitigate CVE-2026-84328

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
Restart browser sessions after the update so the patched binary is loaded into memory
Confirm Chromium-based third-party browsers have integrated the corresponding upstream fix before considering them remediated

Patch Information

Google addressed the issue in the Chrome stable channel update documented in the Chrome Release Update. Upgrading to Chrome 152.0.7977.75 or later removes the vulnerable code path. Enterprise administrators should push the update through their standard Chrome management channels and verify version compliance across the fleet.

Workarounds

No vendor-supplied workaround exists; applying the patched Chrome build is the supported remediation
Restrict browsing to trusted sites and enforce strict web filtering until updates are deployed
Ensure Chrome's site isolation and sandboxing features remain enabled to raise the cost of the prerequisite renderer compromise

bash

# Verify installed Chrome version meets the fixed build
google-chrome --version
# Expected output: Google Chrome 152.0.7977.75 or later