CVE-2026-84325
published 2026-09-02CVE-2026-84325: Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.40%
33.3th percentile
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 152.0.7977.75 | 152.0.7977.75 | |
| chrome | >= 152.0.7977.75 < 152.0.7977.75 | 152.0.7977.75 | |
| chrome_desktop | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 152.0.7977.65 DataTransfer input validation
vuldb·2026-09-02
CVE-2026-84325 [LOW] Google Chrome up to 152.0.7977.65 DataTransfer input validation
A vulnerability marked as problematic has been reported in Google Chrome. This vulnerability affects unknown code of the component DataTransfer. The manipulation leads to improper input validation.
This vulnerability is documented as CVE-2026-84325. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app.
ghsa_unreviewed·2026-09-02
CVE-2026-84325 CWE-20 Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app.
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2026-84325
vendor_chrome·2026-09-10·CVSS 9.8
CVE-2026-84325 [CRITICAL] Long Term Support Channel Update for ChromeOS: CVE-2026-84325
Long Term Support Channel Update for ChromeOS
CVE-2026-84325
Chrome
Stable Channel Update for Desktop: CVE-2026-84351
vendor_chrome·2026-09-01
CVE-2026-84351 [HIGH] Stable Channel Update for Desktop: CVE-2026-84351
Stable Channel Update for Desktop
CVE-2026-84351: Buffer overflow in GPU. Reported by Cassio Lima on 2026-08-24 [N/A][ 553117928 ] High CVE-2026-84325: Improper input validation in DataTransfer
Reported by Google on 2026-08-26 [N/A][ 498710886 ] Medium CVE-2026-84328: Missing authorization in FileSystem
Severity: high
No detection rules found.
No public exploits indexed.
Rapid7
Patch Tuesday - September 2026
blogs_rapid7·2026-09-08·CVSS 7.8
CVE-2026-85880 [HIGH] Patch Tuesday - September 2026
Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday , including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today.
## Windows ALPC: zero-day EoP
The eternal game of elevation of privilege whack-a-mole between Microsoft and attackers continues. This month, the batt
Bugzilla
CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2
bugzilla·2026-09-11·CVSS 9.0
CVE-2026-84324 [CRITICAL] CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2
CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2026-84354 ... chromium: various flaws [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had
Bugzilla
CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2
bugzilla·2026-09-11·CVSS 9.0
CVE-2026-84324 [CRITICAL] CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2
CVE-2026-84324 CVE-2026-84325 CVE-2026-84327 CVE-2026-84329 CVE-2026-84330 CVE-2026-84331 CVE-2026-84332 CVE-2026-84333 CVE-2026-84347 CVE-2026-84348 CVE-2026-84350 CVE-2026-84352 CVE-2026-84353 CVE-2026-84354 ... chromium: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who ha
Bugzilla
CVE-2026-84325 chromium-browser: Chromium: System access restriction bypass via improper input validation
bugzilla·2026-09-01·CVSS 9.8
CVE-2026-84325 [CRITICAL] CVE-2026-84325 chromium-browser: Chromium: System access restriction bypass via improper input validation
CVE-2026-84325 chromium-browser: Chromium: System access restriction bypass via improper input validation
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)
2026-09-02
Published