PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84357 Google CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-02T00:18:29.627Z and has not been modified since then. The vulnerability CVE-2026-84357 is caused by improper input validation in Google Chrome's Omnibox. This allows a remote attacker to bypass web origin policy via crafted network traffic, leveraging social engineering. The vulnerability has a CVSS score of 6.5 and is rated MEDIUM. It was addressed in Google Chrome version 152.0.7977.75. The Chromium security severity is rated High. The CVE-2026-84357 record indicates that Google Chrome versions prior to 152.0.7977.75 are vulnerable due to improper input validation in Omnibox. This allows a remote attacker to bypass web origin policy via crafted network traffic, leveraging social engineering.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-02
Original CVE updated
2026-09-03
Advisory published
2026-09-02
Advisory updated
2026-09-03

Who should care

IT administrators responsible for managing Google Chrome installations, security teams monitoring network traffic for suspicious activity, and users of Google Chrome who may be targeted by social engineering attacks.

Technical summary

The vulnerability CVE-2026-84357 is caused by improper input validation in Google Chrome's Omnibox. This allows a remote attacker to bypass web origin policy via crafted network traffic, leveraging social engineering. The vulnerability has a CVSS score of 6.5 and is rated MEDIUM. It was addressed in Google Chrome version 152.0.7977.75.

Defensive priority

This CVE is rated MEDIUM with a CVSS score of 6.5. It involves improper input validation in Google Chrome's Omnibox, allowing a remote attacker to bypass web origin policy via crafted network traffic, which requires user interaction.

Recommended defensive actions

  • Inventory and verify Google Chrome versions on managed devices to ensure they are updated to 152.0.7977.75 or later.
  • Implement compensating controls such as web application firewalls to detect and block crafted network traffic.
  • Educate users about social engineering tactics and the importance of verifying the authenticity of network traffic.
  • Monitor network traffic for suspicious activity and implement incident response plans.
  • Enforce a strict update policy for Google Chrome to ensure timely patching of vulnerabilities.

Evidence notes

The CVE-2026-84357 record indicates that Google Chrome versions prior to 152.0.7977.75 are vulnerable due to improper input validation in Omnibox. This allows a remote attacker to bypass web origin policy via crafted network traffic, leveraging social engineering. The Chromium security severity is rated High.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84357 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84357

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84357 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84357

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.