EUVD-2026-84423
GHSA-x82f-3vjg-p954
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious framing page
-
DeliveryLure victim to click framed extension UI
-
ExploitUI-redress bypasses frame restrictions
-
ExecutionCapture disclosed sensitive data
-
ImpactExfiltrate information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Exploitation requires a victim who uses the affected FortiPAM Chrome Extension (7.4 any version or 8.0 through 8.0.0) to be lured into visiting and interacting with an attacker-controlled page that frames or overlays the extension's rendered UI (classic clickjacking/UI-redress); the flaw is remote and unauthenticated on the attacker side (PR:N) but is gated by required user interaction (UI:R) and by the victim having the vulnerable extension installed and active. It does not work against default server configurations without a targeted, victim-in-the-loop click, which materially limits real-world exploitability despite the Critical CVSS. |
| Impact | The signals are in tension. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L, 9.6 Critical) rates this near-maximal, but the underlying weakness (CWE-1021, improper restriction of rendered UI layers or frames - i.e. clickjacking/UI-redressing) and the description's own scoping ('information disclosure') are inconsistent with the I:H/A:L impacts claimed; a UI-redress bug that only discloses information should not carry High integrity and any availability impact. The 9.6 is therefore likely inflated versus real-world effect. Mitigating the score further: UI:R means a victim must be lured into interacting with attacker-controlled framed UI, so this is not a fire-and-forget remote exploit. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automatable exploitation - no public exploit identified at time of analysis. Net: despite the Critical number, this reads as a moderate, interaction-dependent, targeted-risk issue affecting a narrow browser-extension component rather than an urgent mass-exploitation priority. Note the description says remote unauthenticated (consistent with PR:N), which the CVSS vector supports. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that transparently frames or overlays the FortiPAM Chrome Extension UI and lures an authenticated FortiPAM user to visit and click. Through UI redressing the victim's interaction is redirected so that sensitive information rendered by the extension is exposed to the attacker. No public proof-of-concept exists at time of analysis, and success depends on the victim performing the interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
UI redress (clickjacking) in the Fortinet FortiPAM Chrome Extension allows an attacker-controlled web page to frame or overlay the extension's rendered interface so that a victim's clicks are redirected into unintended, privileged extension actions, resulting in information disclosure with limited integrity impact. The affected code is the 7.4 branch and the 8.0 builds through 8.0.0 as scoped by Fortinet advisory FG-IR-26-168 (the vendor description covers all 8.0 and 7.4 versions, while ENISA EUVD specifically lists 8.0.1). Exploitation is remote and unauthenticated from the attacker's side (PR:N, CVSS:3.1/AV:N/AC:L/S:C) but is gated by required victim interaction (UI:R) - the user must have the vulnerable extension installed and be lured into clicking within an attacker-planted frame, which materially limits real-world exploitability despite Fortinet's 9.6 score; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed impact (C:H/I:L/A:N) is lower than the vendor rating.
Earlier versions of this analysis (1)
Clickjacking-style UI redress in the Fortinet FortiPAM Chrome Extension (8.0 and 7.4 branches, all versions) allows a remote, unauthenticated attacker to overlay or frame the extension's rendered UI layers and trick a victim into interacting with disguised elements, leading to disclosure of sensitive FortiPAM session or credential data. Exploitation is gated on the victim having the extension installed and active and being lured into a UI action on the attacker-controlled layer (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C), so the issue is not self-propagating; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Fortinet's vendor-assigned base of 9.1 (C:H/I:H/A:L) is materially higher than our independent assessment (C:H/I:N/A:N), which confines the demonstrable impact to confidentiality loss.
RemediationAI
Apply the fixed FortiPAM Chrome Extension build published for advisory FG-IR-26-168 (https://fortiguard.fortinet.com/psirt/FG-IR-26-168); patch availability is indicated by the vendor advisory, but no exact fix version number is present in the supplied data - confirm the corrected release for both the 7.4 and 8.0 branches directly from that advisory before relying on a specific build number. Where an immediate upgrade cannot be validated, the most effective compensating control is to remove or disable the FortiPAM Chrome Extension entirely on affected endpoints and use the FortiPAM web portal or native client instead; the trade-off is loss of the extension's in-browser session and credential-launch convenience, which may push users toward weaker manual credential handling. Enterprises can also block or pin extension installation and updates through Chrome Enterprise policy (ExtensionInstallBlocklist / ExtensionInstallForcelist plus ExtensionSettings to restrict host permissions), which prevents both the vulnerable build and future malicious look-alikes but requires managed browsers and policy refresh. Because the attack depends on framing or overlaying the extension's rendered UI, restricting the extension's site access to only the trusted FortiPAM portal origin via the extension's site-access settings reduces the number of pages that can attempt an overlay, at the cost of breaking legitimate cross-origin workflows. Finally, user-side mitigations such as avoiding clicks inside unexpected or embedded frames and disabling framing-prone content are only behavioral and should not be treated as a substitute for upgrading once a patched build is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), the classic UI-redress/clickjacking weakness. FortiPAM's Chrome extension injects privileged UI (session and credential prompts, PAM connection controls) into the browser rendering context, and it apparently does not adequately constrain which origins may frame or overlay that UI - e.g. missing or ineffective frame-ancestors / X-Frame-Options-equivalent enforcement on extension-rendered pages, insufficient validation of user-gesture provenance, or overly broad exposure of extension resources such as web_accessible_resources and content scripts. Because browser extension pages execute with extension-level privileges rather than page-level privileges, a successful overlay can coerce the victim's clicks into channeling data or actions across the privileged boundary, which explains the high confidentiality and changed-scope (S:C) components of the vector. The CPE cpe:2.3:a:fortinet:fortipam_chrome_extension:*:*:*:*:*:*:*:* confirms the vulnerable component is the extension itself rather than the FortiPAM appliance, and the accompanying XSS tag suggests the same rendered-UI surface may also be reachable through script injection in addition to framing, so both frame-busting and output/injection hardening are relevant. The required user interaction, combined with the need for the extension to be installed and active, means the attack is a targeted, victim-in-the-loop client-side technique rather than a server-side compromise.
Know when Fortipam Chrome Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Remote unauthenticated UI-redress needs victim interaction (UI:R) and crosses into the extension's rendered context (S:C); primary impact is information disclosure (C:H), with at most limited integrity and no availability effect.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack
Articles & Coverage 1
Executive ViewAI
The Fortinet FortiPAM Chrome Extension is affected by a critical clickjacking vulnerability (CVE-2026-84388) that could allow an unauthenticated attacker to trick users into performing privileged actions, leading to information disclosure. With no vendor-released patch identified at time of analysis and no public exploit identified, organizations using FortiPAM for privileged access management should act to mitigate risk. Leadership should prioritize protecting sensitive systems and data by addressing this exposure.
Disable or remove the FortiPAM Chrome Extension until a patch is available; enforce browser policies to block the extension; implement clickjacking protections such as frame-ancestors CSP headers; educate users on clickjacking risks; monitor vendor advisory FG-IR-26-168 for updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB