CVE-2026-84357: Google Chrome Omnibox Auth Bypass Flaw

CVE-2026-84357 Overview

CVE-2026-84357 is an improper input validation vulnerability [CWE-20] in the Omnibox component of Google Chrome. The flaw affects Chrome desktop versions prior to 152.0.7977.75. A remote attacker leveraging social engineering can bypass the web origin policy through crafted network traffic. Google's Chromium security team rated the underlying issue as High severity, while the NVD assigned a medium CVSS score reflecting the required user interaction. The vulnerability primarily impacts integrity, allowing origin confusion within the address bar.

Critical Impact
Successful exploitation lets attackers bypass same-origin protections in the Omnibox, enabling convincing spoofing and phishing scenarios against Chrome users who interact with crafted content.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.75
Chromium-based browsers incorporating the vulnerable Omnibox component
Downstream distributions shipping affected Chrome builds

Discovery Timeline

2026-09-02 - CVE CVE-2026-84357 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84357

Vulnerability Analysis

The vulnerability resides in the Omnibox, the combined address and search bar in Google Chrome. Improper input validation allows crafted network traffic to influence how the browser interprets origin context. An attacker can leverage this behavior to bypass the web origin policy, which normally isolates content between sites. The result is an integrity failure where the browser presents or associates content with an origin the user did not intend to trust. Because Omnibox is the primary trust anchor users rely on to verify the site they are visiting, exploitation supports high-fidelity phishing and content spoofing. The Chromium project classifies the underlying issue as High severity, though NVD scoring reflects the requirement for user interaction.

Root Cause

The root cause is improper input validation [CWE-20] in Omnibox handling of attacker-controlled input. Insufficient sanitization allows crafted values to influence origin interpretation, breaking the browser's web origin policy guarantees.

Attack Vector

Exploitation is network-based and requires user interaction. A remote attacker delivers crafted network traffic, typically alongside social engineering, to trick the user into an action that triggers the Omnibox parsing flaw. No authentication is required. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor-provided context.

No public proof-of-concept code is available. The vulnerability manifests when Omnibox processes malformed input that influences origin interpretation. See the vendor advisory for technical details.

Detection Methods for CVE-2026-84357

Indicators of Compromise

Browser telemetry showing installed Chrome versions below 152.0.7977.75 after the patch release window.
Web proxy logs recording user navigation to newly registered or low-reputation domains referenced by suspicious inbound links.
Endpoint records of Chrome renderer processes accessing content that does not match the origin displayed to the user.

Detection Strategies

Inventory endpoints for Chrome versions and flag any instance below 152.0.7977.75.
Correlate email and messaging security telemetry with browsing activity to identify social engineering lures directing users to crafted content.
Monitor HTTP referer and origin headers for mismatches between the visited domain and downstream requests.

Monitoring Recommendations

Enable browser management policies that report Chrome version state to a central console.
Alert on user reports of address bar inconsistencies, credential prompts on unexpected domains, or unexpected redirects.
Track patch deployment progress against the Google Chrome Desktop Update release notes.

How to Mitigate CVE-2026-84357

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all desktop endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded.
Verify managed Chromium-based browsers have pulled the corresponding upstream fix.

Patch Information

Google addressed the flaw in Chrome Stable Channel 152.0.7977.75 for desktop. Administrators should consult the Google Chrome Desktop Update release notes and the Chromium Issue Tracker Entry to confirm applicability to their deployments.

Workarounds

Enforce user awareness guidance to avoid clicking untrusted links until patching completes.
Restrict browsing to allow-listed domains through web proxy or DNS filtering where feasible.
Deploy enterprise browser policies that disable auto-launching of external protocol handlers from untrusted origins.

bash

# Verify installed Chrome version on Windows managed endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version