CVE-2026-84325: Improper input validation in Google Chrome

The vulnerability CVE-2026-84325 affects Google Chrome versions before 152.0.7977.75. It stems from improper input validation in the DataTransfer functionality, which can be exploited remotely by an attacker leveraging social engineering and a co-installed application to bypass system access restrictions. The flaw is rated critical with a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. Google has published a stable channel update fixing this issue in version 152.0.7977.75.

Successful exploitation allows a remote attacker to bypass system access restrictions, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires social engineering and a co-installed app, but no privileges or user interaction beyond that. The vulnerability is critical due to its high CVSS score and broad impact.

Google has released an official fix in Chrome version 152.0.7977.75. Users and administrators should update affected Chrome installations to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.