CVE-2026-84388

Summary

This vulnerability allows an attacker to disclose information via a remote unauthenticated attack on Fortinet FortiPAM Chrome Extension versions 8.0 and 7.4, due to improper restriction of rendered UI layers or frames.

Exploitability

Exploitation is relatively easy given the remote unauthenticated nature, requiring only a browser with the extension installed.

Blast radius

If exploited, the attacker could gain sensitive information, potentially leading to data breaches or further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the FortiPAM Chrome Extension until a patched version is available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.