CVE-2026-84388 Information disclosure in FortiPAM Chrome Extension
An attacker can disclose information via a remote unauthenticated attack due to improper restriction of rendered UI layers in the FortiPAM Chrome Extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-84388?
CVE-2026-84388 is a critical vulnerability in Fortinet FortiPAM Chrome Extension, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack
Weakness: CWE-1021
Which versions are affected by CVE-2026-84388?
How do I fix CVE-2026-84388?
No fix has been published for CVE-2026-84388 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84388 being exploited?
There is no known exploitation of CVE-2026-84388 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-x82f-3vjg-p954.