CVE-2026-84358 in Chrome
Summary
by MITRE • 09/02/2026
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an improper privilege management issue within Google Chrome prior to version 152.0.7977.75 represents a significant breach in the browser's isolation model, specifically affecting the Downloads feature. This flaw allows for address bar spoofing when triggered by a remote attacker who has already achieved code execution within a renderer process. The core of this vulnerability lies in how Chrome handles user interface elements and navigation states during file download operations. When a malicious HTML page is crafted to exploit this specific logic error, it can manipulate the browser's UI state such that the address bar displays a legitimate or trusted URL while the actual content being rendered originates from an untrusted source. This discrepancy creates a visual deception where users are led to believe they are interacting with a secure and authentic site, thereby undermining their ability to verify the true origin of the web page.
From a technical perspective, this issue stems from insufficient validation checks within the download manager component regarding how navigation events interact with UI updates. In modern browsers like Chrome, renderer processes operate in a sandboxed environment designed to prevent them from affecting other parts of the browser or the host system. However, if an attacker compromises a renderer process through another vulnerability such as a remote code execution flaw, they gain limited but potentially dangerous capabilities. By exploiting this improper privilege management, the compromised renderer can send commands that alter the address bar text without updating the actual navigation history or security context correctly. This results in a state where the visual representation of trust does not match the underlying network request and content origin. The Chromium project classified this with a medium severity rating because while it requires an initial compromise to exploit, its impact on user trust and phishing resistance is substantial.
The operational impact of this vulnerability is primarily centered around social engineering attacks facilitated by address bar spoofing. Attackers can use this technique to create highly convincing phishing pages that appear to be from legitimate domains such as banks, email providers, or corporate intranets. Since the address bar displays a trusted URL, users may lower their guard and proceed to enter sensitive credentials or personal information into forms hosted on the malicious site. This undermines one of the primary defenses against credential harvesting: user vigilance regarding the displayed domain name. Furthermore, this vulnerability can be leveraged in drive-by download scenarios where the visual context is manipulated to make a malicious payload appear as part of a legitimate software update or document retrieval process. The ability to spoof the address bar effectively breaks the chain of trust that users rely on when browsing the web, making it significantly harder for them to distinguish between safe and dangerous content based solely on UI cues.
To mitigate this risk, organizations and individual users must ensure that Google Chrome is updated to version 152.0.7977.75 or later immediately upon availability. This update contains patches that enforce stricter separation of concerns between the download manager and the UI rendering components, ensuring that address bar updates are synchronized correctly with actual navigation events. Additionally, security teams should reinforce multi-factor authentication policies to reduce the value of stolen credentials obtained through such phishing attempts. Users should also be educated on verifying website authenticity through additional indicators beyond just the URL in the address bar, such as checking for valid SSL certificates and looking for subtle inconsistencies in page design or functionality that might indicate a spoofed site. Regular security awareness training remains critical to complement technical controls against sophisticated social engineering attacks enabled by browser vulnerabilities.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where the software does not properly assign privileges for operations on objects based upon user roles or identities. In this context, the renderer process is granted more control over UI state than it should possess relative to its security level. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, in scenarios where an attacker uses compromised credentials or processes to maintain access and deceive users. Furthermore, the address bar spoofing aspect relates to techniques used in phishing campaigns that rely on visual deception to bypass user scrutiny. Understanding these mappings helps security professionals categorize similar issues within their environments and prioritize remediation efforts based on established industry frameworks for vulnerability management and threat intelligence.