CVE-2026-84331: Google Chrome Actor Authorization Bypass

CVE-2026-84331 Overview

CVE-2026-84331 is an incorrect authorization vulnerability in the Actor component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.75. A remote attacker who has already compromised the renderer process can bypass web origin policy through a crafted HTML page. Chromium classifies the security severity as Low.

The vulnerability maps to CWE-863: Incorrect Authorization. Exploitation requires user interaction and a pre-existing renderer compromise, which raises the attack complexity. Successful exploitation impacts confidentiality by permitting cross-origin data access that the same-origin policy should block.

Critical Impact
An attacker with a compromised renderer process can violate the web origin boundary and access data from unrelated origins loaded in the browser.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.75
Chromium-based builds that embed the vulnerable Actor component
Downstream browsers tracking the Chromium stable channel before the September 2026 update

Discovery Timeline

2026-09-02 - CVE-2026-84331 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84331

Vulnerability Analysis

The defect resides in the Actor component of Chrome. Actor is responsible for mediating actions between browser subsystems, and its authorization checks failed to correctly enforce the web origin policy. When the checks are bypassed, an attacker can perform operations that read or influence resources belonging to a different web origin.

Exploitation is not a straightforward drive-by scenario. The attacker must first compromise the renderer process, then deliver a crafted HTML page that triggers the flawed authorization path. Because the renderer is sandboxed, this vulnerability is most useful as a stage in a chained attack rather than a standalone primitive.

The impact is limited to confidentiality of same-origin data. Integrity and availability are not affected, and no privilege escalation outside the browser process boundary occurs. See the Chromium Issue Tracker Entry for developer-side references.

Root Cause

The Actor component performed authorization decisions without correctly validating the requesting origin against the target resource. This is a classic CWE-863 pattern where an authorization check exists but its logic is incomplete. The result is that a renderer under attacker control can issue requests that Actor accepts as legitimate cross-origin operations.

Attack Vector

The attack chain requires two conditions. First, the attacker must already control a Chrome renderer process, typically through a separate memory-corruption or logic bug. Second, the attacker must serve or reference a crafted HTML page that invokes the Actor path with parameters that defeat the origin check.

Once both conditions are met, the crafted page causes Actor to authorize an operation across origin boundaries. See the Chrome Releases Update advisory for release-level details.

No verified proof-of-concept code is publicly available for this issue, and the description of the exploitation mechanism above is based on the vendor advisory rather than a released exploit.

Detection Methods for CVE-2026-84331

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.75 on managed endpoints
Renderer processes making unexpected requests to unrelated web origins during a single page session
HTML content that references internal Actor-related IPC surfaces or repeatedly triggers cross-origin resource loads

Detection Strategies

Inventory browser versions across the fleet and flag any Chrome installation below the patched build
Correlate renderer crash telemetry with subsequent anomalous network requests, since renderer compromise is a prerequisite for exploitation
Review browser telemetry and proxy logs for cross-origin data flows that do not match expected application behavior

Monitoring Recommendations

Enable enterprise browser reporting to surface installed Chrome versions and update lag
Forward endpoint browser process telemetry to a centralized analytics pipeline for behavioral baselining
Alert on chained indicators such as renderer exploitation attempts followed by unusual outbound origin access

How to Mitigate CVE-2026-84331

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all endpoints
Restart browsers after the update to ensure the patched binaries are loaded
Audit any Chromium-derived browsers deployed internally and apply their vendor equivalents

Patch Information

Google addressed CVE-2026-84331 in the Chrome stable channel update announced on the Chrome Releases blog. Administrators should confirm rollout through enterprise management tooling and verify that endpoints report the patched build. Chromium-based browser vendors typically incorporate the fix in their subsequent stable releases.

Workarounds

No official workaround has been published; patching is the supported remediation path
Restrict browsing to trusted sites and enforce strict content policies to reduce exposure to renderer compromises
Use enterprise policies to block execution of untrusted HTML content from unmanaged sources until updates are applied

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Expected output should be 152.0.7977.75 or newer