External risk intelligence

Google Chrome DataTransfer Input Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84325

This vulnerability requires a co-installed application on the local system and the use of social engineering to be exploited. It is client-side in nature and not a service intended for direct public-internet exposure.

Google Chrome

before 152.0.7977.75

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in Google Chrome that could allow remote attackers to bypass system access controls. This vulnerability is facilitated through social engineering and requires a co-installed application on the user's device. The primary concern is to confirm whether this specific technology is in use within the organization and if any exposure exists.

Input validation flaw in Chrome.
Requires social engineering and co-installed app.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into opening a malicious link, which, if the user also has a specific co-installed application, could allow the attacker to bypass normal system access controls through the vulnerable data transfer feature in Chrome. This could lead to unauthorized access and modification of the system.

Requires a co-installed app.
Triggers via social engineering.
Bypasses system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious website to access or modify data on a user's system when a co-installed app is present and the user is tricked into interacting with the website. This could lead to unauthorized data exposure or manipulation through the interaction between the malicious website and the co-installed application.

System data could be affected.
Through social engineering and a co-installed app.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's DataTransfer component requires a co-installed application and social engineering to exploit, suggesting a need for collaboration between application owners and endpoint security teams. The first practical step is to identify all Chrome instances, confirm their reachability and business criticality, and then assign ownership for remediation planning based on risk.

Application and endpoint security teams own.
Verify Chrome instances and reachability.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Chrome DataTransfer component?

It is a core part of the Chrome browser responsible for handling how data moves between the browser and the operating system or other software. This includes managing clipboard operations, drag-and-drop actions, and data exchange with third-party applications. Because it manages these bridge points, improper handling of information can create security boundaries that attackers may attempt to cross.

What does CWE-20 improper input validation mean for CVE-2026-84325?

CWE-20 refers to a weakness where software receives data but fails to properly verify that the information is safe or correctly formatted before processing it. In the context of this CVE, the browser does not sufficiently inspect data coming from a web source. This failure allows the software to be misled, effectively granting unauthorized actions because the system incorrectly trusts the incoming, potentially malicious data.

How is this Chrome vulnerability triggered?

The flaw is triggered when a user is tricked by social engineering—such as clicking a deceptive link—into interacting with a malicious website. Importantly, simply having a vulnerable version of Chrome is not enough; the attack also requires a specific co-installed application to be present on the same device. If the user does not have that secondary application, this specific bypass path is not functional.

Is this vulnerability a risk for internet-facing systems?

According to Halo Surface Signal, this vulnerability is client-side in nature and is not a service intended for public-internet exposure. While the attack begins via the internet through social engineering, the risk is localized to the end-user's device. Therefore, it does not pose the same type of threat as a remote-accessible server service, but remains a concern for workstations where users interact with untrusted web content.

What are the first steps to address this CVE?

Start by identifying all devices in your environment running Google Chrome. Since remediation requires coordination, involve both your endpoint management and application support teams to track current browser versions. Prioritize updates on systems where users frequently handle sensitive information or where third-party software integrates with the browser, ensuring the update to version 152.0.7977.75 or later is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.