External risk intelligence

Google Chrome FileSystem Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-84354

This vulnerability resides within the client-side browser application. Successful exploitation requires a user to be socially engineered into visiting a crafted web page, meaning the surface is not an internet-facing service or appliance, but rather an endpoint-based client application.

Google Chrome

before 152.0.7977.75

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Google Chrome's file system handling that could permit attackers to execute code outside the browser's security sandbox. The threat requires a user to interact with a malicious web page, indicating a focus on user-side exploitation rather than direct server compromise. While the technical severity is high, its exploitation relies on social engineering, making its direct business impact uncertain without further analysis of user exposure.

Flaw allows code execution via malicious web pages.
Requires user interaction, not direct system access.
Focus on confirming relevance and user exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This webpage could then interact with a weakness in Chrome's FileSystem component to break out of the browser's security sandbox and run unauthorized code on the user's device.

Requires user to visit a malicious page.
Crafted HTML page triggers vulnerability.
Allows code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote attacker could leverage social engineering to execute arbitrary code outside the Chrome sandbox via a crafted HTML page, potentially impacting system data and user data on affected endpoints.

System data could be compromised.
Social engineering may lead to exposure.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome, making client-side security and endpoint management teams the primary responders. The initial step is to identify all endpoints running the affected browser version, confirm their exposure to external links, and then prioritize remediation based on user risk and business criticality.

Endpoint and browser owners.
Verify browser reachability and user exposure.
Plan targeted updates or user guidance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FileSystem component in Google Chrome?

The FileSystem component is a browser feature that manages how web applications read, write, and organize files on your local device. It acts as an interface between websites and your computer's storage, operating within strict security boundaries called a sandbox to prevent unauthorized access to your operating system.

What does CWE-863 mean for CVE-2026-84354?

CWE-863 refers to Incorrect Authorization. In the context of this vulnerability, it means the browser fails to properly verify if a webpage has the correct permissions to perform specific file operations. An attacker can exploit this weakness to bypass established security rules and run unauthorized commands on your device that the browser should have blocked.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by luring a user to visit a malicious HTML page designed to interact with the broken authorization logic. Simply having the browser installed is not enough; the vulnerability does not trigger automatically through background network traffic or while the browser is idle. It specifically requires the user to interact with the crafted content.

Is this a risk for my internet-facing servers?

According to Halo Surface Signal, this is not a server-side threat. Because the vulnerability exists within the browser application itself, it is considered an endpoint risk rather than an internet-facing service or appliance issue. The primary risk is to individual user devices where the browser is running, not to backend infrastructure.

How should I respond to this Chrome security update?

The most effective first step is to verify the versions of Google Chrome running across your managed endpoints. Prioritize updating browsers that are on versions earlier than 152.0.7977.75. Since this attack relies on social engineering, also consider reinforcing user awareness about avoiding untrusted links and suspicious web pages.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.