Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab
Source Reddit NetSec
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until an official fix is available, users should exercise caution when visiting untrusted websites and consider disabling or removing the FortiPAM Chrome extension if possible.
Discussion
CVE-2026-84388 is a critical vulnerability in the FortiPAM Chrome extension used for Privileged Access Management. It allows any website visited by the user to manipulate the browser's proxy settings for the session and to open new tabs that can be screen recorded and streamed to an attacker's server. This enables attackers to conduct phishing attacks by capturing sensitive user activity in attacker-controlled tabs without user consent.
r/netsec (opens in a new tab)u/acorn2220 points0 comments
TL;DR. The FortiPAM Chrome extension (1M+ users), used for Privileged Access Management, allowed any site to set the browser's proxy for the session, alongside allowing any site to create a new tab and send screen recordings of it to an attacker's server. That makes for trivial phishing attacks which only require the user to view something sensitive in the attacker-opened tab. CVSS 9.1 | CVE-2026-84388.
Impact
An attacker can manipulate the user's browser proxy settings and open new tabs that are screen recorded and streamed to the attacker. This compromises user privacy and security by enabling phishing attacks that capture sensitive user interactions in attacker-controlled tabs. The vulnerability affects user sessions and can lead to unauthorized data exposure.
Summary
The FortiPAM Chrome extension, which has over 1 million users and is used for Privileged Access Management, contains a critical vulnerability (CVE-2026-84388). This flaw permits any website visited by the user to control the browser's proxy settings during the session and to open new tabs that can be screen recorded and streamed to an attacker's server. The vulnerability facilitates trivial phishing attacks by allowing attackers to capture sensitive user activity in tabs they control without the user's knowledge or consent. The CVSS score is reported as 9.1, indicating high severity.