CVE-2026-84323 in Chrome
Summary
by MITRE • 09/02/2026
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as missing authorization in the FileSystem component of Google Chrome prior to version 152.0.7977.75 represents a significant breach in browser-based access control mechanisms. This flaw specifically affects how the Chromium engine handles file system operations, allowing for unauthorized data retrieval under specific conditions. The core issue lies in the insufficient validation of permissions when accessing files through the File System Access API or related internal interfaces. In a properly secured environment, any request to read from or write to the local file system must be explicitly authorized by the user and validated against strict origin-bound policies. However, due to this defect, certain operations could bypass these checks if initiated under particular circumstances involving renderer process compromise.
The operational impact of this vulnerability is primarily centered on information disclosure. An attacker who has successfully compromised a browser's renderer process can leverage social engineering techniques to trick the user into interacting with a malicious HTML page. Once the victim engages with the crafted content, the application may execute file system operations that are not properly authorized. This allows the remote attacker to read sensitive files from the local machine without explicit permission or awareness of the end-user. The severity is classified as medium by Chromium security standards because while it requires an initial foothold in the renderer process and user interaction via social engineering, the potential for exfiltrating confidential data such as documents, credentials stored locally, or other personal information poses a tangible risk to user privacy and organizational security postures.
From a technical perspective, this flaw aligns with CWE-269, which describes Improper Authorization, where an actor is able to access resources or perform actions for which they should not have been granted permission. Furthermore, the attack vector relates to ATT&CK technique T1059, Command and Scripting Interpreter, as it involves executing code within the browser environment that subsequently interacts with the operating system's file subsystem. The exploitation chain typically begins with a drive-by download or phishing attempt leading to the execution of malicious JavaScript embedded in an HTML page. This script then attempts to access local files through APIs that fail to enforce strict origin checks or user consent prompts, effectively bypassing the sandbox boundaries intended to isolate web content from the host system.
Mitigation strategies for this vulnerability involve immediate updates to the browser software. Users and organizations should upgrade Google Chrome to version 152.0.7977.75 or later, where these authorization checks have been reinforced. Additionally, security teams should enforce strict Content Security Policies (CSP) within web applications served by their domains to limit the capabilities of embedded scripts. Implementing robust user education programs regarding social engineering tactics can also reduce the likelihood of successful exploitation since human interaction is a prerequisite for this specific attack path. Regular auditing of browser configurations and ensuring that third-party extensions do not introduce similar authorization flaws are recommended best practices to maintain a secure browsing environment.