CVE-2026-84358: Improper privilege management in Google Chrome

This vulnerability in Google Chrome's Downloads feature allows an attacker with control over the renderer process to spoof the browser's address bar by using a crafted HTML page. The flaw stems from improper privilege management, which could mislead users about the actual URL they are visiting. The issue affects versions prior to 152.0.7977.75. The CVSS vector indicates that the attack requires network access, high attack complexity, no privileges required, user interaction, and results in low confidentiality and low availability impact.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof the address bar, potentially misleading users about the legitimacy of the website they are visiting. This could facilitate phishing or social engineering attacks. The impact is limited to low confidentiality and low availability, with no integrity impact reported. There are no known exploits in the wild at this time.

The vendor advisory link is provided but does not explicitly confirm patch availability or remediation steps. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution with untrusted content and avoid compromising the renderer process.