CVE-2026-84357: Improper input validation in Google Chrome

This vulnerability in Google Chrome's Omnibox allows improper input validation, enabling a remote attacker to bypass the web origin policy by leveraging crafted network traffic and social engineering techniques. The issue affects versions prior to 152.0.7977.75. The CVSS 3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has published an advisory for this issue.

The vulnerability allows an attacker to bypass the web origin policy, potentially leading to unauthorized actions or data manipulation within the browser context. The integrity of web content can be compromised, but there is no direct impact on confidentiality or availability. Exploitation requires user interaction and social engineering.

Google has released an official fix in Chrome version 152.0.7977.75. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.