CVE-2026-84388

CVE-2026-84388 is an improper restriction of rendered UI layers or frames (CWE-1021) in Fortinet's FortiPAM Chrome Extension, affecting all versions of the 8.0 and 7.4 branches. It is exploited remotely and without authentication, but the CVSS vector (UI:R) indicates the victim must interact with attacker-controlled content — realistically, visiting a malicious or compromised website while the extension is installed in their browser. Press coverage indicates that by manipulating the extension's rendered frames, a malicious site can control the browser's proxy settings and record tab activity, yielding information disclosure and integrity impact within the browser context (CVSS 9.6, with high confidentiality and integrity impact across security scopes). Affected users are privileged-access users at organizations deploying FortiPAM who have installed the companion Chrome extension. No public proof-of-concept exists, the issue is not on CISA's KEV list, and no exploitation in the wild has been reported to date.

What to do: Update the FortiPAM Chrome Extension on all managed browsers to a fixed build per Fortinet's PSIRT advisory (anything still on the 8.0 or 7.4 branch is vulnerable); if a fix is not yet deployed, remove or disable the extension via enterprise Chrome policy. Check browsers for unexplained proxy configuration changes or unusual tab/screen recording activity as signs of attempted abuse, and review which FortiPAM privileged users actually need the extension installed.