CVE-2026-84355

LowCVSS 3.1/10Last modified Sep 3, 2026

Description

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Google	Chrome	>= 152.0.7977.75, < 152.0.7977.75

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/511774376Permissions Required

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-843564.3UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML CVE-2026-843576.5Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypa CVE-2026-843584.2Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rendere CVE-2026-843593.1Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak CVE-2026-843608.1Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSessi CVE-2026-843617.7Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Compos CVE-2026-843635.9Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question CVE-2026-843645.3Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separate CVE-2026-843656.5Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-20 CVE-2026-843667.4Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S CVE-2026-843673.7joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js intern CVE-2026-843683.7joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through