Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass… (CVE-2026-84325)

CVE-2026-84325 describes an improper input validation flaw in the DataTransfer feature of Google Chrome before version 152.0.7977.75. This vulnerability enables a remote attacker, through social engineering tactics and the presence of a co-installed app, to circumvent system access controls. The issue is categorized under CWE-20 (Improper Input Validation). No CVSS score or detailed exploit information is available, and no known exploits are reported in the wild.

The vulnerability could allow an attacker to bypass system access restrictions, potentially leading to unauthorized actions or data access facilitated by a co-installed application. The severity is considered high by Chromium security standards, indicating significant risk if exploited.

A fix is available in Google Chrome version 152.0.7977.75. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.