CVE-2026-84358: Improper privilege management in Google Chrome

This vulnerability in Google Chrome's Downloads feature allows an attacker with control over the renderer process to spoof the browser's address bar. The flaw is due to improper privilege management, classified under CWE-269. It affects versions of Chrome before 152.0.7977.75 and has a CVSS 3.1 base score of 4.2 (medium severity). No known exploits in the wild have been reported. The vulnerability does not allow direct code execution or full compromise but can mislead users by spoofing the address bar, potentially facilitating phishing or social engineering attacks.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof the address bar in Chrome, potentially misleading users about the legitimacy of the website they are visiting. This could aid in phishing attacks or other social engineering tactics. The impact on confidentiality is low, with no integrity impact and low availability impact as per the CVSS vector.

A fix is available in Google Chrome version 152.0.7977.75. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, applying the official update is the recommended mitigation. No additional vendor advisory content was provided, so check Google's official security bulletins for confirmation and further guidance.