Executive brief
Google Chrome contains a missing authorization vulnerability in its FileSystem API that could allow an attacker with a compromised renderer process to access sensitive files. The attack requires both a compromised browser process and social engineering to trick a user into visiting a malicious web page, potentially leading to unauthorized access to user data and files.
Technical details
The vulnerability is a missing authorization flaw in Chrome's FileSystem implementation (CVE-2026-84323). An attacker who has compromised the renderer process can bypass authorization checks when accessing files through a crafted HTML page, leveraging social engineering to increase the likelihood of user interaction. The attack vector is network-based but requires the renderer process to already be compromised as a precondition. A successful exploit allows unauthorized file access and information disclosure. Google patched this issue in Chrome version 152.0.7977.75 and later.
Affected products
- Google Chrome prior to 152.0.7977.75
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in Chrome 152.0.7977.75