CVE-2026-84335: Google Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The attacker must first compromise the Chrome renderer process and then use social engineering to get the target to interact with a crafted HTML page. Successful exploitation could allow code execution outside Chrome's sandbox.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.75 are affected. Updating to 152.0.7977.75 or later addresses the issue.

Q: Are users protected by Chrome's sandbox?

Not reliably in this scenario. The issue could allow an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox.

Published Sep 1, 2026

Updated

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Google Chrome<152.0.7977.75

Event History

Sep 1, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must first compromise the Chrome renderer process and then use social engineering to get the target to interact with a crafted HTML page. Successful exploitation could allow code execution outside Chrome's sandbox.

Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.75 are affected. Updating to 152.0.7977.75 or later addresses the issue.

Are users protected by Chrome's sandbox?

Not reliably in this scenario. The issue could allow an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox.