CVE-2026-84354: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's FileSystem authorization allows remote attackers to bypass sandbox restrictions and execute arbitrary code by leveraging social engineering techniques. The flaw exists in versions before 152.0.7977.75. The CVSS 3.1 score of 9.6 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor has released a stable channel update addressing this issue.

Successful exploitation can lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. This can result in full system compromise, data theft, or disruption of service. The vulnerability requires user interaction (social engineering) but no prior privileges, making it a significant risk to end users.

Users and administrators should update Google Chrome to version 152.0.7977.75 or later, where this vulnerability is fixed. The vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html confirms the availability of this update. No additional mitigations are specified or required once the update is applied.