Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-84325: input validation bypass in Google Chrome

Remote attackers can bypass system access restrictions in Google Chrome by exploiting improper input validation in DataTransfer, tracked as CVE-2026-84325. The issue affects Chrome releases before 152.0.7977.75; the fix is included in 152.0.7977.75. Successful exploitation, according to reports, requires social engineering and the presence of a co‑installed application that an attacker can leverage to escalate privileges or access resources outside Chrome's intended protections. There is no public exploit reported, but the impact can be severe on exposed endpoints.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00402
CWE
CWE-20
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

High urgency: this is a critical (CVSS 9.8) remote input‑validation flaw with a vendor fix available; update Chrome to 152.0.7977.75 as soon as possible.

What is CVE-2026-84325?

Remote attackers can bypass system access restrictions in Google Chrome by exploiting improper input validation in DataTransfer, tracked as CVE-2026-84325. The issue affects Chrome releases before 152.0.7977.75; the fix is included in 152.0.7977.75. Successful exploitation, according to reports, requires social engineering and the presence of a co‑installed application that an attacker can leverage to escalate privileges or access resources outside Chrome's intended protections. There is no public exploit reported, but the impact can be severe on exposed endpoints.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Google Chrome are affected?

BRANCHAFFECTEDFIXED
152.x152.0.7977.75 – before 152.0.7977.75152.0.7977.75

Is CVE-2026-84325 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-84325

  1. Update Google Chrome to 152.0.7977.75 or later.
  2. If immediate update is not possible, restrict installation and execution of untrusted co‑installed applications and extensions.
  3. Monitor endpoints for unusual interactions between Chrome and local applications and review application installation policies.
  4. Follow Google’s release notes and security guidance for any additional mitigation steps.

Frequently asked questions

Is CVE-2026-84325 being actively exploited?

There are no public reports of exploitation as of 2026-09-29.

Which Chrome versions are affected by CVE-2026-84325?

Chrome releases prior to 152.0.7977.75 are affected; the issue is fixed in 152.0.7977.75.

Is there a patch for CVE-2026-84325?

Yes. Google fixed the vulnerability in Chrome version 152.0.7977.75.

Does CVE-2026-84325 require authentication?

Exploitation leverages social engineering and a co‑installed app rather than authenticated access; an attacker must trick a user or leverage an installed application to exploit Chrome.

References