CVE-2026-84335 Overview
CVE-2026-84335 is an incorrect authorization vulnerability [CWE-863] in the TabStrip component of Google Chrome versions prior to 152.0.7977.75. A remote attacker who has already compromised the renderer process can leverage social engineering to execute arbitrary code outside the browser sandbox. Exploitation requires user interaction and a crafted HTML page. The Chromium project rated the security severity as Medium, while the NVD scoring places it in the higher range due to sandbox escape potential and scope change. Successful exploitation breaks the fundamental security boundary that isolates web content from the host operating system.
Critical Impact
Attackers chaining a renderer compromise with this flaw can escape the Chrome sandbox and execute arbitrary code on the victim host through a crafted HTML page and user interaction.
Affected Products
- Google Chrome Desktop versions prior to 152.0.7977.75
- Chromium-based browsers incorporating the vulnerable TabStrip component
- All platforms supported by the Chrome Stable channel prior to the fixed release
Discovery Timeline
- 2026-09-02 - CVE-2026-84335 published to NVD
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-84335
Vulnerability Analysis
The vulnerability resides in the TabStrip component, which manages browser tab state and lifecycle within Chrome's browser process. TabStrip performed insufficient authorization checks on operations requested from renderer processes. Because the browser process runs at a higher privilege level than sandboxed renderers, missing authorization allows a compromised renderer to invoke privileged actions it should not reach. The flaw maps to [CWE-863: Incorrect Authorization]. Exploitation is not standalone. An attacker must first achieve code execution inside a renderer, typically through a separate memory-safety bug, then combine it with social engineering to trigger the privileged TabStrip path.
Root Cause
The root cause is an authorization gap between the sandboxed renderer and the browser-process TabStrip logic. Requests originating from an untrusted renderer were accepted without confirming that the caller was permitted to perform the action. This missing enforcement is the classic pattern captured by [CWE-863], where the system checks that a user is authenticated but fails to verify whether the specific action is authorized.
Attack Vector
The attack begins with a crafted HTML page delivered to a targeted user. The renderer must already be compromised through a separate vulnerability. The attacker then uses social engineering, such as a deceptive user interface prompt, to induce interaction that triggers the vulnerable TabStrip code path. Successful exploitation escapes the sandbox and yields code execution in the browser-process context. Refer to the Google Chrome Desktop Update and the Chromium Issue Tracker Entry for the vendor's technical description.
Detection Methods for CVE-2026-84335
Indicators of Compromise
- Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters from the browser process on Windows, macOS, and Linux hosts.
- Anomalous file writes or persistence artifacts created by Chrome browser-process instances outside the normal profile directory.
- Outbound network connections from Chrome to previously unseen infrastructure immediately following user interaction with a suspicious page.
Detection Strategies
- Hunt for renderer-to-browser process privilege transitions that result in non-standard child process creation from chrome.exe or the platform equivalent.
- Inspect Chrome version telemetry across the fleet to identify endpoints running builds earlier than 152.0.7977.75.
- Correlate browser crash reports with subsequent suspicious process activity that could indicate a chained sandbox escape.
Monitoring Recommendations
- Deploy EDR rules that flag Chrome browser-process spawning of scripting hosts or LOLBins.
- Monitor endpoint inventory for Chrome versions and alert on installations below the patched release.
- Track web proxy logs for downloads from domains associated with malvertising and social-engineering lures targeting Chrome users.
How to Mitigate CVE-2026-84335
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints.
- Force-restart Chrome after the update to ensure the patched binaries are loaded into memory.
- Audit deployed Chromium-based browsers, such as Edge and Brave, and apply their respective vendor updates once released.
Patch Information
Google addressed CVE-2026-84335 in Chrome Stable channel release 152.0.7977.75. Details are available in the Google Chrome Desktop Update and the Chromium Issue Tracker Entry. Enterprise administrators should push the update through managed update channels and verify installation via version telemetry.
Workarounds
- Restrict browsing to trusted sites through enterprise policy until the patch is deployed, since exploitation requires user interaction with a crafted page.
- Enforce site isolation and disable unnecessary browser extensions that expand the renderer attack surface.
- Train users to recognize and reject unexpected in-browser prompts that request additional interaction, which is the social-engineering step required by this chain.
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
