CVE-2026-84328: Missing authorization in Google Chrome

This vulnerability involves missing authorization checks in the FileSystem feature of Google Chrome before version 152.0.7977.75. An attacker who has already compromised the renderer process can exploit this to bypass the web origin policy by delivering a specially crafted HTML page. This could potentially allow unauthorized access to resources that should be restricted by origin policy. The CVSS score of 3.1 reflects a low severity impact, primarily limited to confidentiality with no impact on integrity or availability. No official remediation level or patch is explicitly stated in the vendor advisory.

The impact is limited to a confidentiality breach through bypassing the web origin policy, which could allow unauthorized reading of data across origins if the renderer process is compromised. There is no impact on integrity or availability. Exploitation requires prior compromise of the renderer process, which limits the attacker's capabilities and overall risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. No explicit patch or official fix has been stated in the provided data. Until a patch is confirmed, users should follow standard security practices to prevent renderer process compromise.