CVE-2026-84354 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization flaw within the FileSystem component of Google Chrome prior to version 152.0.7977.75 represents a critical breach in browser-based access control mechanisms. This issue stems from a failure in the application logic responsible for validating user permissions when interacting with local file system resources through web APIs. In modern browsers, sandboxing is employed to isolate untrusted content, such as pages loaded from remote servers, from sensitive host operating system functions. However, this specific implementation error allowed the security boundary between the browser's secure context and the underlying operating system to be bypassed under certain conditions. The flaw essentially permitted a web page to request or manipulate file system resources without proper authorization checks being enforced by the renderer process before passing requests to higher-privilege processes.
The operational impact of this vulnerability is severe, as it enables arbitrary code execution outside the browser's sandbox environment. An attacker can leverage social engineering techniques to trick a victim into visiting a specially crafted HTML page containing malicious JavaScript or other web technologies designed to exploit this authorization gap. Once the user interacts with the page in a manner that triggers the flawed logic, the attacker gains the ability to execute arbitrary code on the victim's machine with the privileges of the browser process. This effectively neutralizes one of the primary defenses against remote exploitation, allowing for potential data theft, installation of malware, or complete compromise of the system depending on the user's local permissions and installed software configurations.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, specifically regarding authorization failures that allow access to resources without proper rights. Furthermore, in the context of the MITRE ATT&CK framework, this exploit technique relates to T1059 Command and Scripting Interpreter, as it facilitates the execution of code on a target system through browser-based vectors. The use of social engineering highlights the importance of user awareness alongside technical controls, as the initial access vector relies heavily on deceiving the end-user into initiating the malicious interaction.
Mitigation strategies for this vulnerability primarily involve immediate software updates to ensure that all instances of Google Chrome are upgraded to version 152.0.7977.75 or later, where these authorization checks have been corrected and hardened. Organizations should enforce automated patch management policies to minimize the window of exposure across their user base. Additionally, implementing strict content security policies (CSP) can help restrict the types of scripts that are allowed to execute within browser contexts, thereby reducing the attack surface for such exploits even if a vulnerability exists in the underlying engine. Users should also be educated on recognizing suspicious web interactions and avoiding execution of unknown or untrusted file system operations initiated by web pages.