CVE-2026-84356: Google Chrome XSS Vulnerability

CVE-2026-84356 Overview

CVE-2026-84356 is a user interface misrepresentation vulnerability in the FullScreen component of Google Chrome prior to version 152.0.7977.75. A remote attacker can spoof the address bar by serving a crafted HTML page to a targeted user. The flaw is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium's internal triage rated the security severity as Low, while NVD scored the issue at 4.3 (Medium). Successful exploitation requires user interaction, such as entering FullScreen mode on a malicious site.

Critical Impact
An attacker can display a forged address bar in FullScreen mode, enabling convincing phishing pages that impersonate legitimate origins.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.75
Chromium-based browsers using the same FullScreen implementation
All operating systems supported by the Chrome stable channel

Discovery Timeline

2026-09-02 - CVE-2026-84356 published to NVD
2026-09-02 - Last updated in NVD database
2026-09 - Fix shipped in the Chrome Stable Channel Update for Desktop

Technical Details for CVE-2026-84356

Vulnerability Analysis

The vulnerability resides in Chrome's FullScreen mode, which hides browser chrome, including the address bar, to give web content full display control. When a page enters FullScreen, an attacker-controlled HTML document can render pixel content that mimics the browser's own address bar and security indicators. Because the real address bar is suppressed, the user has no reliable trust anchor to distinguish the spoofed UI from authentic chrome. The attack targets confidentiality of user decisions rather than memory or code execution, which is why the confidentiality and availability impacts are none while integrity is limited. See the Chromium Issue Tracker Entry for triage context.

Root Cause

The root cause is insufficient separation between rendered page content and trusted browser UI while FullScreen is active. Chrome does not surface a persistent, unspoofable origin indicator during the transition and steady state of FullScreen. This maps directly to [CWE-451], where security-relevant information is presented in a way that a user can misinterpret.

Attack Vector

The attacker hosts a crafted HTML page and lures the victim to visit it. The page programmatically requests FullScreen, which requires a user gesture such as a click. Once granted, the page draws a fake omnibox with an arbitrary URL and lock icon over its own content. The victim can then be prompted to enter credentials or approve prompts, believing the session is on a trusted domain.

No verified exploit code is publicly available. The behavior is described in prose based on the vendor advisory and Chromium issue tracker.

Detection Methods for CVE-2026-84356

Indicators of Compromise

Browser telemetry showing frequent Element.requestFullscreen() invocations from newly registered or low-reputation domains.
Phishing reports where users describe seeing a legitimate URL despite landing on an untrusted host.
Web proxy logs recording navigation to pages that immediately transition into FullScreen upon first click.

Detection Strategies

Inspect Chrome version strings reported by managed endpoints and flag hosts running builds earlier than 152.0.7977.75.
Correlate user-reported phishing incidents with referrer chains that include FullScreen-enabling pages.
Use secure web gateway rules to identify pages that combine FullScreen APIs with credential input forms.

Monitoring Recommendations

Monitor endpoint inventory for Chrome patch level compliance and alert on drift from the fixed build.
Track user reports of address bar anomalies through a phishing report button in the mail client.
Review DNS and proxy logs for lookalike domains that host FullScreen-triggering landing pages.

How to Mitigate CVE-2026-84356

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints.
Restart Chrome after the update so the patched binary is loaded into memory.
Push the update to Chromium-based browsers that share the FullScreen implementation once upstream vendors publish rebased builds.

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Chrome Releases blog. Enterprises using managed update policies should confirm the 152.0.7977.75 build has been staged and delivered. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Disable the FullScreen API for untrusted sites using enterprise policy such as FullscreenAllowedForUrls and FullscreenBlockedForUrls.
Train users to press Escape and observe browser chrome before entering credentials on any page.
Deploy phishing-resistant authentication such as FIDO2 security keys to reduce the value of a successful spoof.

bash

# Chrome enterprise policy example (Windows registry) restricting FullScreen
# HKLM\Software\Policies\Google\Chrome\FullscreenAllowedForUrls
reg add "HKLM\Software\Policies\Google\Chrome\FullscreenAllowedForUrls" /v 1 /t REG_SZ /d "https://[*.]corp.example.com" /f
reg add "HKLM\Software\Policies\Google\Chrome\FullscreenBlockedForUrls" /v 1 /t REG_SZ /d "*" /f