CVE-2026-84358: 
vulnerability analysis and mitigation

CVE-2026-84358 is an improper privilege management vulnerability in the Downloads component of Google Chrome that allows a remote attacker who has already compromised the renderer process to spoof the address bar via a crafted HTML page. It affects all versions of Google Chrome prior to 152.0.7977.75. The vulnerability was reported by Google on 2026-05-17 and publicly disclosed on 2026-09-01 as part of a 26-fix stable channel update. It carries a CVSS v3.1 base score of 4.2 (Medium) (Chrome Releases, Red Hat CVE).

The vulnerability is classified under CWE-269 (Improper Privilege Management) and CWE-290 (Authentication Bypass by Spoofing), rooted in insufficient privilege controls within Chrome's Downloads component. An attacker who has already achieved renderer process compromise can leverage this flaw to manipulate the address bar display, potentially deceiving users about the true origin of content or downloads. Exploitation requires user interaction and high attack complexity, as the attacker must first compromise the renderer process before abusing this flaw. The Chromium issue tracker references bug ID 514006886 for this vulnerability (Chrome Releases, Red Hat CVE).

Successful exploitation allows an attacker to spoof the browser's address bar, potentially misleading users into believing they are interacting with a trusted site or downloading a legitimate file. The CVSS assessment indicates low confidentiality and availability impact with no direct integrity impact, limiting the scope to the affected browser instance without privilege escalation beyond the renderer sandbox. The primary risk is social engineering facilitated by address bar spoofing, which could be chained with other attacks to increase phishing or malware delivery effectiveness (Red Hat CVE, Chrome Releases).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.00156, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies it as non-automatable with partial technical impact (Red Hat CVE, Feedly).

Google has released a fix in Chrome stable channel version 152.0.7977.75 (Linux) and 152.0.7977.75/.76 (Windows and Mac). Users and administrators should update Google Chrome to version 152.0.7977.75 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should use managed update policies to ensure fleet-wide patching (Chrome Releases, Microsoft MSRC).

The vulnerability was covered as part of broader reporting on Google's 26-fix Chrome stable channel update, with security outlets such as CyberSecurityNews, GBHackers, and CyberPress highlighting the overall patch batch — particularly the two critical use-after-free flaws — rather than CVE-2026-84358 specifically. CIS issued an advisory noting that multiple vulnerabilities in the update could allow arbitrary code execution. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified (CyberSecurityNews, CIS Advisory).