CVE-2026-84358 Overview
CVE-2026-84358 is an improper privilege management flaw [CWE-269] in the Downloads component of Google Chrome versions prior to 152.0.7977.75. A remote attacker who has already compromised the renderer process can spoof the address bar by delivering a crafted HTML page. Google has assigned this issue a Chromium security severity of Medium.
Address bar spoofing undermines the primary trust indicator users rely on to verify site identity. When combined with a compromised renderer, it enables convincing phishing and credential harvesting scenarios against Chrome users.
Critical Impact
Attackers with renderer-level compromise can misrepresent the current URL displayed to users, enabling phishing and social engineering against otherwise attentive victims.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.75
- Chromium-based browsers that ship the vulnerable Downloads component
- All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds
Discovery Timeline
- 2026-09-02 - CVE-2026-84358 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84358
Vulnerability Analysis
The vulnerability resides in how Chrome's Downloads subsystem handles privilege boundaries between the renderer process and the browser process. Chrome enforces a multi-process security model where the renderer is untrusted and the browser process gates privileged operations, including URL display in the omnibox.
When a compromised renderer initiates or manipulates a download flow with a crafted HTML page, the resulting state transition allows the address bar to present a URL that does not match the actual origin serving content. This breaks the origin-to-omnibox binding that users rely on for trust decisions.
Exploitation requires user interaction and relies on high attack complexity, but delivers no direct code execution. The impact is limited to confidentiality and availability at a low level, primarily through downstream phishing.
Root Cause
The root cause is improper privilege management [CWE-269] between the Downloads component and the address bar rendering logic. The browser process fails to strictly validate the origin context associated with a download-initiated navigation, permitting a renderer-controlled URL to persist in the omnibox after the actual content source changes.
Attack Vector
Exploitation follows a two-stage chain. The attacker first compromises the renderer process through a separate vulnerability or a malicious site. The attacker then serves a crafted HTML page that triggers the download-related state confusion, causing the omnibox to display an attacker-chosen URL while different content is presented.
No verified proof-of-concept code is publicly available. Refer to the Chromium Issue Tracker entry #514006886 and the Google Chrome Stable Update announcement for vendor details.
Detection Methods for CVE-2026-84358
Indicators of Compromise
- Chrome desktop clients reporting version strings below 152.0.7977.75 in endpoint inventory
- Unexpected download prompts followed by navigation events to unrelated origins in browser telemetry
- Phishing reports where victims describe seeing a legitimate URL but different site content
- Renderer process crashes or anomalous child-process behavior preceding download events
Detection Strategies
- Inventory Chrome versions across managed endpoints and flag hosts below 152.0.7977.75 for patching
- Correlate browser process telemetry with download initiation events to identify mismatches between displayed URL and actual network destination
- Monitor for renderer exploitation precursors, since this flaw is only reachable after renderer compromise
Monitoring Recommendations
- Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time
- Alert on outbound connections to newly registered or low-reputation domains that follow download activity
- Review phishing-reporting queues for user descriptions consistent with address bar spoofing
How to Mitigate CVE-2026-84358
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.75 or later on all desktop endpoints
- Verify that Chromium-based browsers in the environment have adopted the corresponding upstream fix
- Restart Chrome after update deployment to ensure the patched binary is loaded
Patch Information
Google addressed CVE-2026-84358 in Chrome Stable 152.0.7977.75. Refer to the Google Chrome Stable Update announcement for the full release notes and to the Chromium Issue Tracker entry #514006886 for the underlying bug reference. Deploy the update through enterprise management tooling such as Chrome Browser Cloud Management or standard software distribution.
Workarounds
- No official workaround exists; apply the vendor patch as the primary remediation
- Reinforce user awareness training on verifying site identity beyond the address bar for high-value transactions
- Restrict browser extensions and reduce renderer attack surface to lower the likelihood of the prerequisite renderer compromise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
