Google Chrome CVE-2026-84358

Exploitation requires two hard prerequisites: (1) the attacker must have already achieved code execution within the Chrome renderer process via a separate, independent vulnerability, and (2) user interaction with a crafted HTML page is required (UI:R). The renderer compromise cannot be bypassed - this vulnerability is not exploitable as a standalone network-level attack. Exploitation is limited to Chrome desktop versions prior to 152.0.7977.75. No special browser configuration or non-default feature is required beyond running a vulnerable Chrome build; the flaw is in the core Downloads component.

The CVSS 4.2 score (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) correctly encodes the high attack complexity imposed by the mandatory renderer compromise prerequisite. However, the I:N metric is inconsistent with address bar spoofing, which by definition falsifies information displayed to the user - a form of integrity impact that should register as at least I:L. The A:L metric in the provided vector also lacks an obvious basis for a pure UI-spoofing vulnerability; both metric assignments should be verified against the upstream Chromium bug report. No EPSS data was provided, and the vulnerability does not appear in CISA KEV. Chromium's own Medium severity rating aligns with the CVSS score and reflects the two-bug-chain requirement. The realistic risk is constrained: exploitation demands a separate renderer exploit, making standalone targeting impractical, though address bar spoofing is a well-known second-stage technique for defeating user trust verification in chained browser exploit chains.

An attacker first exploits a separate renderer-process vulnerability - such as a memory corruption bug in the V8 JavaScript engine or a Blink DOM handler - to gain code execution within Chrome's sandboxed renderer. From that compromised renderer, they serve a crafted HTML page that triggers the Downloads privilege management flaw, causing the browser address bar to display an attacker-controlled URL. The spoofed address bar then deceives the victim into believing they are interacting with a trusted domain, enabling credential phishing or further social engineering.