FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs
Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.
The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.
- webRequest listener trusts hostnames without validating initiator, letting attacker domains pose as FortiPAM servers
- externally_connectable all_urls plus token validation gaps allow unauthenticated session launches and proxy control
- Consent dialog rendered in page DOM can be auto-accepted via shadow-root clicks
- Fix released August 1 in advisory FG-IR-26-168; no in-the-wild exploitation confirmed
- CVEs
- CVE-2026-84388
- Vendors
- Fortinet
- Products
- FortiPAM
- Organizations
- Am I Being Pwned
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84388 | Unauthenticated UI-Layer Flaw in Fortinet FortiPAM Chrome Extension | 9.6 | <1% | PoC |
From the original article
2 min read at gbhackers.com
A critical vulnerability has been identified in the Fortinet FortiPAM Chrome extension that could allow a malicious website to manipulate browser proxy settings, open tabs at the attacker’s discretion, and record activity within those tabs. This issue, tracked as CVE-2026-84388 and rated with a CVSS score of 9. 1, impacts an extension that facilitates privileged access […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.