CVE-2026-84357: 
vulnerability analysis and mitigation

CVE-2026-84357 is an improper input validation vulnerability in the Omnibox component of Google Chrome that allows a remote attacker leveraging social engineering to bypass the web origin policy via crafted network traffic. It affects all versions of Google Chrome prior to 152.0.7977.75 and was reported by Google on June 12, 2026, with the fix disclosed on September 1, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Chrome Releases).

The vulnerability is rooted in insufficient input validation (CWE-20) within Chrome's Omnibox (address bar) component, leading to an origin validation error (CWE-346). An attacker can craft malicious network traffic and use social engineering to trick a user into interacting with it, causing Chrome to incorrectly evaluate or trust a web origin and bypass the same-origin policy. Exploitation requires user interaction (e.g., visiting a malicious page or clicking a crafted link) but no special privileges or authentication. The Chromium issue tracker references bug ID 523208474 (Chrome Releases, Feedly).

Successful exploitation allows an attacker to bypass web origin policy, potentially enabling unauthorized cross-origin requests or actions that should be restricted by browser security boundaries. The primary impact is on integrity (CVSS integrity impact: High), with no direct confidentiality or availability impact. This could allow an attacker to perform actions on behalf of a user across origins, potentially leading to data manipulation, unauthorized API calls, or session-related attacks within the browser context (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.159%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction via social engineering.

1. Reconnaissance: Identify targets using Google Chrome versions prior to 152.0.7977.75 on Windows, Mac, or Linux.
2. Craft malicious content: Prepare a web page or network resource with crafted network traffic designed to manipulate how Chrome's Omnibox processes and validates origin information.
3. Social engineering: Lure the target user into visiting the malicious page or interacting with a crafted link (e.g., via phishing email, malicious advertisement, or redirected URL).
4. Trigger origin bypass: When the user interacts with the crafted content, Chrome's Omnibox fails to properly validate the input, causing it to incorrectly evaluate the web origin and bypass the same-origin policy.
5. Achieve objective: With the origin policy bypassed, the attacker can perform cross-origin requests or actions that would normally be blocked, potentially manipulating data or performing unauthorized actions in the context of another origin (Chrome Releases, Feedly).

Google has released a fix in Chrome 152.0.7977.75 (Linux) and 152.0.7977.75/.76 (Windows and Mac). Users and administrators should update Google Chrome to version 152.0.7977.75 or later immediately. Additionally, organizations should educate users about social engineering tactics and suspicious links to reduce the risk of exploitation. No configuration-based workaround is available; patching is the only remediation (Chrome Releases, Feedly).

The vulnerability was part of a broader Chrome 152 security update that patched 26 vulnerabilities, including two Critical-rated use-after-free flaws, which drew significant media attention. Security outlets including CyberSecurityNews, GBHackers, and The Daily Tech Feed covered the release, focusing primarily on the critical memory bugs rather than CVE-2026-84357 specifically (CyberSecurityNews, GBHackers). CIS also issued an advisory noting that multiple vulnerabilities in the update could allow for arbitrary code execution (CIS Advisory).