CVE-2026-84328: Google Chrome vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker must already have compromised the Chrome renderer process. The described exploit then uses a crafted HTML page to bypass the web origin policy.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.75 are affected.

Q: What is the security impact after exploitation?

A compromised renderer process can bypass the web origin policy through a crafted HTML page, due to missing authorization in FileSystem.

Published Sep 1, 2026

Updated

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<152.0.7977.75

Event History

Sep 1, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must already have compromised the Chrome renderer process. The described exploit then uses a crafted HTML page to bypass the web origin policy.

Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.75 are affected.

What is the security impact after exploitation?

A compromised renderer process can bypass the web origin policy through a crafted HTML page, due to missing authorization in FileSystem.