CVE-2026-84323: Missing authorization in Google Chrome

This vulnerability in Google Chrome's FileSystem component allows a remote attacker, after compromising the renderer process and leveraging social engineering, to bypass authorization controls and obtain sensitive information through a specially crafted HTML page. The issue affects Chrome versions before 152.0.7977.75. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

An attacker who has already compromised the renderer process and can trick a user via social engineering may gain unauthorized access to sensitive information through the FileSystem component. The confidentiality of data can be compromised, but integrity and availability are not impacted. There are no known exploits in the wild at this time.

The vulnerability is fixed in Google Chrome version 152.0.7977.75. Users and administrators should update to this version or later to remediate the issue. The vendor advisory linked provides the official update information. No additional mitigation steps are indicated.