CVE-2026-84355 Overview
CVE-2026-84355 is an incorrect authorization vulnerability [CWE-863] in the Navigation component of Google Chrome. The flaw affects versions prior to 152.0.7977.75. An attacker who has already compromised the renderer process can bypass web origin policy by delivering a crafted HTML page. Chromium classifies the security severity as Medium. The issue requires a prior renderer compromise and user interaction, which limits its standalone exploitability but makes it valuable as a second-stage primitive in a browser exploit chain.
Critical Impact
A remote attacker with a compromised renderer process can bypass same-origin protections and access cross-origin resources through a crafted HTML page.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.75
- Chromium-based browsers sharing the affected Navigation code path
- Embedded applications using vulnerable Chromium builds
Discovery Timeline
- 2026-09-02 - CVE-2026-84355 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84355
Vulnerability Analysis
The vulnerability resides in Chrome's Navigation logic, which is responsible for enforcing origin-based access decisions during page transitions. Incorrect authorization checks allow a compromised renderer to influence navigation state in ways that violate the web origin policy. This effectively breaks the same-origin boundary that isolates content between web principals.
Exploitation requires the attacker to already control a renderer process. That precondition is typically satisfied by chaining this issue with a separate memory-corruption or logic bug in the renderer. Once chained, the attacker can leverage a crafted HTML page to read or interact with resources from origins that should be inaccessible.
The scope of impact is confidentiality of cross-origin data. Integrity and availability are not directly affected. Because user interaction is required, exploitation typically involves social-engineered navigation such as clicking a link or interacting with attacker-controlled content.
Root Cause
The root cause is an authorization check that does not correctly validate the origin context during navigation. The Navigation code path fails to enforce that a renderer's requested transition respects the security principal of the target document.
Attack Vector
The attack vector is network-based and requires user interaction. A remote attacker hosts a crafted HTML page and lures a victim to navigate to it. Combined with an existing renderer compromise, the malicious page triggers the incorrect authorization path and bypasses origin isolation. See the Chromium Issue #511774376 tracker for additional technical context.
No verified public exploit code is available. Refer to the Google Chrome Stable Update advisory for vendor details.
Detection Methods for CVE-2026-84355
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.75 after the patch release window
- Unexpected cross-origin resource access requests originating from renderer processes
- Renderer processes making navigation requests inconsistent with the parent frame's origin
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag hosts below 152.0.7977.75
- Monitor browser telemetry for renderer crash patterns or sandbox anomalies preceding suspicious navigation events
- Correlate web proxy logs for unusual cross-origin fetch sequences following user navigation to unknown domains
Monitoring Recommendations
- Enable enterprise browser reporting to surface version drift and extension activity
- Collect endpoint process telemetry for chrome.exe child processes and command-line arguments
- Alert on high-volume navigation to newly registered or low-reputation domains from managed browsers
How to Mitigate CVE-2026-84355
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
- Restart Chrome after the update to ensure the patched Navigation code is loaded
- Audit Chromium-based applications and Electron builds for the vulnerable version and update accordingly
Patch Information
Google addressed the vulnerability in Chrome Stable 152.0.7977.75. Details are available in the Google Chrome Stable Update advisory and the Chromium Issue #511774376 tracker.
Workarounds
- Enforce automatic browser updates through enterprise policy to eliminate version drift
- Restrict execution of untrusted extensions that can influence renderer behavior
- Apply site isolation policies and block navigation to untrusted external domains where feasible
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on Linux
google-chrome --version
# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
