CVE-2026-84332 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization flaw within the SiteSettings component of Google Chrome represents a significant breach in browser-level access control mechanisms. This issue stems from improper validation or enforcement of permissions associated with specific websites, allowing entities that should be restricted to gain elevated privileges. In the context of web browsers, SiteSettings manages how individual sites interact with sensitive features such as location tracking, camera access, microphone input, and notification prompts. When these settings are not correctly enforced during runtime, it creates a pathway for unauthorized data exfiltration or system interaction. The vulnerability was present in versions of Google Chrome prior to 152.0.7977.75, indicating that users running older builds were exposed to this risk until the patch was applied.
From a technical perspective, the flaw involves a logic error where the browser fails to properly verify whether a requesting origin has been granted explicit permission by the user or administrator before allowing an action. Typically, browsers maintain a database of permissions mapped to specific origins. When a webpage attempts to access a protected API, the browser should check this database and block the request if no consent exists. In this case, the enforcement mechanism was bypassed via a crafted HTML page. An attacker could construct a malicious web page that triggers these sensitive APIs without triggering the usual permission prompts or checks. This allows the script embedded in the HTML to execute commands or retrieve data as if it had legitimate user authorization, effectively neutralizing one of the primary defense layers against cross-site scripting and privilege escalation attacks within the browser environment.
The operational impact of this vulnerability is substantial for end-users who visit maliciously crafted websites. A remote attacker can exploit this flaw to bypass system access restrictions, leading to potential unauthorized surveillance through camera or microphone activation without user knowledge. Furthermore, it could allow the theft of sensitive information such as geolocation data, clipboard contents, or other browser-stored credentials if those features are improperly scoped. The Chromium security severity is rated as Medium because while the attack requires a remote vector and specific crafted content, the ability to bypass core privacy controls undermines trust in the browsing experience. Users may unknowingly grant persistent access to their devices through automated scripts that exploit this authorization gap before they realize what has occurred.
This type of vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, and falls under ATT&CK technique T1053, specifically related to scheduled tasks or background processes if the browser allows persistent execution contexts. It also relates to CWE-749, where a system exposes an unsafe operation that could be used by attackers to bypass security features. To mitigate this risk, organizations must ensure that all endpoints are updated to Chrome version 152.0.7977.75 or later immediately upon availability. Additionally, users should exercise caution when visiting untrusted websites and consider using browser extensions that enforce stricter permission policies or block scripts from accessing sensitive APIs without explicit user interaction. Regular security audits of web applications served by internal systems can also help identify if any legitimate services are inadvertently relying on default permissions that could be exploited in this manner.