CVE-2026-84354 Overview
CVE-2026-84354 is an incorrect authorization vulnerability [CWE-863] in the FileSystem component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.75 and allows a remote attacker to escape the browser sandbox. Exploitation requires user interaction with a crafted HTML page, placing this vulnerability in the social engineering attack category. Successful exploitation results in arbitrary code execution outside the sandbox, giving attackers execution context on the host operating system. Google's Chromium security team rated the internal severity as High.
Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox by convincing users to visit a malicious HTML page.
Affected Products
- Google Chrome versions prior to 152.0.7977.75
- Chromium-based browsers incorporating the vulnerable FileSystem component
- Desktop Chrome Stable channel builds released before the September 2026 update
Discovery Timeline
- 2026-09-02 - CVE-2026-84354 published to NVD
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-84354
Vulnerability Analysis
The vulnerability resides in the Chrome FileSystem component and stems from incorrect authorization logic [CWE-863]. The FileSystem API mediates browser access to local storage areas and enforces origin-based permission checks. When authorization is not correctly applied, a page can access or invoke FileSystem operations outside its intended permission scope.
Because the flaw allows escape from the renderer sandbox, an attacker who compromises the renderer through a crafted HTML page can execute code in the browser's higher-privileged context. This transforms a browser-level compromise into full host code execution under the user's account.
Root Cause
The root cause is an authorization check failure inside the FileSystem implementation. The component does not correctly verify that a caller holds the privileges required for the requested operation. As a result, code running in a restricted renderer can invoke FileSystem operations that should be gated behind sandbox boundary enforcement.
Attack Vector
Exploitation is remote and network-based. A victim must navigate to a crafted HTML page controlled by the attacker, typically delivered through phishing, malvertising, or a compromised website. Once loaded, the page issues FileSystem operations that bypass authorization checks and pivot into code execution outside the sandbox. See the Chromium Issue Tracker #498839176 and the Google Chrome Stable Update for vendor detail. No public proof-of-concept is available at time of publication, and the EPSS probability of exploitation is currently 0.24%.
Detection Methods for CVE-2026-84354
Indicators of Compromise
- Chrome renderer or browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
- Unusual file writes into user-writable paths originating from chrome.exe outside the standard cache and profile directories
- Outbound network connections from Chrome child processes to newly registered or low-reputation domains immediately after page navigation
Detection Strategies
- Baseline Chrome process trees and alert on deviations, particularly non-standard child process creation from chrome.exe
- Inspect endpoint telemetry for FileSystem API activity followed by process creation or module load events in the same session
- Correlate browser navigation events with subsequent suspicious file writes or persistence attempts on the same host
Monitoring Recommendations
- Track Chrome version inventory across the fleet and flag hosts running builds prior to 152.0.7977.75
- Ingest browser and endpoint process telemetry into a central data lake for cross-source correlation of exploitation patterns
- Monitor phishing and web proxy logs for user visits to newly observed domains delivering HTML payloads targeting Chromium
How to Mitigate CVE-2026-84354
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
- Force a Chrome restart after deployment to ensure the patched binary is loaded into memory
- Audit Chromium-based browsers such as Edge, Brave, and Opera and apply vendor updates once available
Patch Information
Google addressed CVE-2026-84354 in the Chrome Stable channel release 152.0.7977.75. Details are published in the Google Chrome Stable Update announcement. Administrators should deploy the update through enterprise management tooling and validate installed versions across the fleet.
Workarounds
- Restrict browsing to trusted sites through web proxy or DNS filtering until patches are deployed
- Deliver user awareness reminders about opening unsolicited links, since exploitation requires user interaction
- Enforce least-privilege user accounts so post-exploitation code executes without administrative rights
# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
