CVE-2026-84335: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's TabStrip component allows incorrect authorization checks. An attacker who has already compromised the renderer process and employs social engineering techniques could exploit this flaw by delivering a crafted HTML page, potentially leading to arbitrary code execution outside the browser sandbox. The issue affects Chrome versions prior to 152.0.7977.75. The CVSS 3.1 vector indicates network attack vector, high complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. This can result in full system compromise or unauthorized access to sensitive data. The vulnerability affects confidentiality, integrity, and availability at a high level.

The vendor advisory linked indicates a stable channel update for desktop Chrome. Since the affected version is prior to 152.0.7977.75 and the vulnerability description states it affects versions before this, updating to version 152.0.7977.75 or later mitigates the issue. Users and administrators should apply the official Chrome update as provided by Google. Patch status is not explicitly confirmed in the advisory content provided, so check the vendor advisory for the latest remediation guidance.