CVE-2026-84388: FortiPAM Chrome Extension Disclosure Flaw

CVE-2026-84388 Overview

CVE-2026-84388 is an improper restriction of rendered UI layers or frames vulnerability [CWE-1021] affecting the Fortinet FortiPAM Chrome Extension. The flaw impacts FortiPAM Chrome Extension 8.0 (all versions) and FortiPAM Chrome Extension 7.4 (all versions). A remote unauthenticated attacker can leverage the weakness to disclose sensitive information when a user interacts with attacker-controlled content. The issue is typically associated with clickjacking or UI redressing techniques that trick users into interacting with hidden or overlaid interface elements.

Critical Impact
Remote unauthenticated attackers can obtain sensitive information from FortiPAM sessions by leveraging UI redressing against users of the affected Chrome extension versions.

Affected Products

Fortinet FortiPAM Chrome Extension 8.0 (all versions)
Fortinet FortiPAM Chrome Extension 7.4 (all versions)
Browser sessions where the vulnerable extension is installed and active

Discovery Timeline

2026-09-22 - CVE-2026-84388 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-84388

Vulnerability Analysis

The vulnerability is classified under [CWE-1021]: Improper Restriction of Rendered UI Layers or Frames. This weakness class covers clickjacking and UI redressing attacks where a target application fails to enforce controls that prevent it from being embedded or overlaid by malicious content. In the context of the FortiPAM Chrome Extension, which handles privileged access management workflows, an attacker can construct a page that visually manipulates or overlays extension UI elements. When the victim interacts with the crafted page, actions are performed against the extension in a manner unintended by the user, and sensitive information can leak to the attacker.

Root Cause

The root cause is the absence or inadequacy of frame-ancestor and rendering restrictions in the affected extension versions. Without controls such as strict Content Security Policy frame-ancestors directives, X-Frame-Options, or equivalent enforcement inside the extension's rendered contexts, third-party pages can embed or overlay extension views. This enables an attacker to manipulate what the user perceives and interacts with in the browser.

Attack Vector

Exploitation requires user interaction with an attacker-controlled web page. The attacker does not need credentials or prior access to the target environment. The user visits a malicious page in a browser where the vulnerable FortiPAM Chrome Extension is installed. The page embeds or overlays extension UI, capturing clicks or extracting rendered content to disclose privileged information such as session data, credential metadata, or PAM-managed secrets exposed through the extension interface.

No verified proof-of-concept code has been published. Technical details are available in the Fortinet Security Advisory FG-IR-26-168.

Detection Methods for CVE-2026-84388

Indicators of Compromise

Browser telemetry showing the FortiPAM Chrome Extension loaded within cross-origin iframes on untrusted pages
Unexpected outbound requests from user endpoints to unknown domains hosting overlay or framing content
User reports of unusual FortiPAM prompts, transparent overlays, or unexpected clicks producing PAM actions

Detection Strategies

Inventory installed browser extensions across managed endpoints and flag FortiPAM Chrome Extension versions in the 7.4 and 8.0 branches
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains preceding FortiPAM activity
Correlate FortiPAM audit logs with user browser session data to identify actions initiated without a legitimate workflow

Monitoring Recommendations

Enable extension inventory reporting in enterprise Chrome management to track version drift
Alert on FortiPAM privileged actions that originate outside expected administrative workstations or time windows
Review browser console and CSP violation reports for unexpected framing attempts targeting the extension

How to Mitigate CVE-2026-84388

Immediate Actions Required

Review the Fortinet Security Advisory FG-IR-26-168 and apply the fixed version identified by the vendor
Restrict use of the FortiPAM Chrome Extension to managed browsers with enterprise policy controls until the patched version is deployed
Communicate the risk of UI redressing to FortiPAM users and instruct them to avoid interacting with the extension on untrusted sites

Patch Information

Fortinet published advisory FG-IR-26-168 covering CVE-2026-84388. Administrators should consult the advisory for the specific fixed extension version and upgrade all endpoints running FortiPAM Chrome Extension 7.4 and 8.0 branches. See the Fortinet Security Advisory FG-IR-26-168 for authoritative version guidance.

Workarounds

Temporarily disable or remove the FortiPAM Chrome Extension on endpoints that cannot be patched immediately
Enforce enterprise browser policies that block installation of unapproved extensions and restrict browsing to vetted sites for privileged users
Deploy strict Content Security Policy and site isolation settings via browser management to reduce cross-origin framing exposure

bash

# Example: enforce Chrome extension version pinning and blocklist via enterprise policy
# /etc/opt/chrome/policies/managed/fortipam_policy.json
{
  "ExtensionInstallForcelist": [
    "<extension-id>;https://clients2.google.com/service/update2/crx"
  ],
  "ExtensionSettings": {
    "<extension-id>": {
      "installation_mode": "force_installed",
      "minimum_version_required": "<fixed-version-from-FG-IR-26-168>"
    }
  }
}