Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web… (CVE-2026-84357)

CVE-2026-84357 describes an improper input validation flaw in the Omnibox feature of Google Chrome before version 152.0.7977.75. This flaw enables a remote attacker, using social engineering techniques, to bypass the web origin policy through specially crafted network traffic. The vulnerability is categorized under CWE-20 (Improper Input Validation). There is no CVSS score or detailed vendor advisory available, and no known exploits have been reported.

Successful exploitation could allow an attacker to bypass the web origin policy, potentially enabling unauthorized web content to appear as if it originates from a trusted source. This could facilitate phishing or other social engineering attacks. However, no active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Google Chrome security advisories for updates and apply the official fix once available.