CVE-2026-84323: Google Chrome vulnerability

Q: What must an attacker achieve before this issue can be exploited?

The attacker must first compromise the Chrome renderer process and then use social engineering to induce interaction with a crafted HTML page. This is not described as a standalone, unauthenticated remote exploit.

Q: What is the potential impact?

A successful attack could allow access to sensitive information through the FileSystem component.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or later.

Published Sep 1, 2026

Updated

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<152.0.7977.75

Event History

Sep 1, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker achieve before this issue can be exploited?

The attacker must first compromise the Chrome renderer process and then use social engineering to induce interaction with a crafted HTML page. This is not described as a standalone, unauthenticated remote exploit.

What is the potential impact?

A successful attack could allow access to sensitive information through the FileSystem component.

Which Chrome versions should be remediated?

Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or later.