CVE-2026-84388

Executive Summary

CVE-2026-84388 is a high-severity (CVSS 9.6) improper restriction of rendered UI layers or frames vulnerability (CWE-1021) affecting the Fortinet FortiPAM Chrome Extension, specifically all versions in the 8.0 and 7.4 release branches. The flaw permits a remote, unauthenticated attacker to conduct information disclosure against users of the extension, with the primary precondition being some form of user interaction (UI:R). Due to the scope change (S:C) and high confidentiality and integrity subscores, exploitation could result in meaningful exposure of sensitive data handled through the privileged access management interface. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability remains unpatched per all tracked sources.

Technical Analysis

CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) is the classic vulnerability class underlying clickjacking and related UI-redressing attacks. In this class, an application renders a user interface element in a context where an attacker-controlled layer or frame can be overlaid, obscured, or positioned relative to it — without the application enforcing adequate frame-busting, layering, or origin restrictions. The result is that a victim interacts with attacker-influenced UI, believing they are interacting with the legitimate application. The trust boundary between the trusted UI and the untrusted surrounding page is not properly enforced.

CVE-2026-84388 manifests this weakness inside the FortiPAM Chrome Extension. FortiPAM is Fortinet's Privileged Access Management product; its Chrome Extension functions as part of the privileged session workflow — for example, brokering or rendering privileged access sessions within the browser. An extension that fails to properly restrict rendered UI layers or frames can allow an attacker-controlled page to frame, overlay, or position content in a way that subverts the intended user interface. The NVD description explicitly characterises this as an "improper restriction of rendered ui layers or frames" vulnerability that "may allow attacker to information disclosure via remote unauthenticated attack."

The specific code-level mechanism — the exact DOM elements, framing attributes, message-passing paths, or extension APIs involved — is not disclosed in the available CNA/NVD text. Accordingly, the analysis here is deliberately bounded at the vulnerability-class level: the flaw is a UI-layer/frame restriction failure in a browser extension used within a privileged access context, and it is remotely triggerable without authentication, subject to a user-interaction precondition. Any claim about named functions, manifest permissions, URL endpoints, or parameter names would be speculation and is therefore not asserted.

Relevant CVSS 3.1 characteristics and their meaning:

• AV:N (Network) — the attack vector is remotely reachable; the malicious page or content is served over the network.
• AC:L (Low) — no special conditions beyond the user interaction are required.
• PR:N (None) — no authentication or privileges on the target are needed.
• UI:R (Required) — the victim must perform some interaction (e.g., visiting a crafted page or clicking within it) for the flaw to be realised.
• S:C (Changed) — impact crosses a security scope boundary, consistent with a browser-extension context interacting with external web content.
• C:H / I:H — high confidentiality and integrity impact.
• A:L (Low) — limited availability impact.

The combination of S:C, C:H, and I:H is notable: it indicates that successful exploitation can affect resources beyond the immediate vulnerable component and can compromise both the confidentiality and the integrity of data in that broader scope. For a tool built around privileged access, the confidentiality impact is the most operationally sensitive dimension.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-84388. The attack chain below is therefore inferred strictly from the vulnerability class (CWE-1021) and the NVD description. It does not assert specific function names, endpoints, or parameters, none of which are disclosed.

1. Reconnaissance / target identification. The attacker identifies organisations that deploy FortiPAM with the affected Chrome Extension versions (8.0 or 7.4, all versions). Because the attack is remote and unauthenticated (AV:N, PR:N), the attacker needs only a way to reach the victim user — typically by hosting or injecting a malicious web page that the victim visits while the extension is active. Target identification is thus largely about the victim population (FortiPAM users in the relevant branches) rather than about the FortiPAM server itself.

2. Triggering the specific flaw class. The attacker crafts a page that leverages the extension's failure to properly restrict rendered UI layers or frames. In the CWE-1021 class, this generally means positioning attacker-controlled content in a layer or frame such that it visually or functionally overlaps, frames, or imitates legitimate extension-rendered UI. When the victim's browser loads this crafted content (the UI:R precondition), the boundary between trusted extension UI and untrusted page content is not correctly enforced. The precise technical trigger is not specified in the available description.

3. Payload / execution method (vulnerability-class level). The "payload" here is the attacker-controlled page and its layout/overlay logic, rather than a memory-corruption or injection payload. The objective is to induce the victim to interact with a UI element that the attacker influences, or to cause content to be rendered or framed in a manner that exposes information. Because the description cites information disclosure as the outcome, the interaction is aimed at surfacing data that should not be exposed to the attacker-controlled context.

4. Post-exploitation impact. The stated consequence is information disclosure (C:H), delivered via a remote, unauthenticated attack. Given the changed scope (S:C) and high integrity impact (I:H), the compromised trust boundary could also allow manipulation of what the user sees or acts upon within the extension UI. In a privileged access management context, disclosed information could be highly sensitive; however, the exact data types and extent are not specified in the available source text and should not be assumed.

Practically, exploitation is constrained by the UI:R precondition: the victim must visit or interact with attacker-controlled content. This makes the attack suitable for phishing-style delivery and watering-hole scenarios rather than blind, fully automated mass exploitation.

Impact Assessment

The CVSS 3.1 base score is 9.6, placing this firmly in the Critical range. The score is driven by:

• AV:N and PR:N — remote, unauthenticated reachability widens the attacker population.
• AC:L — the low attack complexity lowers the barrier once a victim is engaged.
• UI:R — a genuine constraint that requires victim interaction, but one readily satisfied through phishing or malicious-page delivery.
• S:C — impact crosses a security scope boundary, indicating effects beyond the directly vulnerable component.
• C:H and I:H — high confidentiality and integrity impact, meaning sensitive data exposure and potential tampering with what the user perceives/acts upon.
• A:L — limited availability impact.

Business impact is concentrated in organisations that use FortiPAM for privileged access management. Although the extension runs in the endpoint browser, the trust context it operates within is tied to privileged-access workflows, so information disclosed through the extension may be more sensitive than ordinary browsing data. From a sector perspective, enterprises with strong privileged-access-management programs — finance, healthcare, critical infrastructure, government — carry the highest exposure profile, since FortiPAM is typically deployed precisely to protect high-value administrative access.

Blast radius considerations: the vulnerable component is the Chrome Extension (both 8.0 and 7.4 branches, all versions), not necessarily the FortiPAM appliance itself. The user-interaction requirement means exploitation is per-victim and campaign-oriented rather than a single-shot server compromise. Nonetheless, because the affected versions span two full release branches with no fixed version identified, remediation is complicated: every deployed extension instance in those branches should be treated as affected until Fortinet issues guidance. The absence of a patch and the absence of an EPSS score mean quantitative exploit-likelihood forecasting is not currently possible; analysts should treat the risk as high but track vendor advisories closely.

Detection Guidance

Detection for a UI-layer/frame-restriction flaw is primarily client- and behaviour-oriented rather than signature-oriented, since no exploit artifacts are public. The rules below are defensive heuristics focused on framing/overlay activity and FortiPAM-extension-related network or process telemetry. They are deliberately generic because the vulnerability's precise technical trigger is undisclosed.

Sigma Rule

title: Suspected UI Redressing / Frame Restriction Abuse Against FortiPAM Chrome Extension
id: 3f9a1c2e-7b4d-4e21-9a0c-8d5e6f7a1b2c
status: experimental
description: Detects browser processes loading content referencing FortiPAM in a framing or overlay context consistent with CWE-1021 abuse (CVE-2026-84388). Heuristic only.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84388
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_args:
    CommandLine|contains:
      - 'fortipam'
      - 'iframe'
      - 'sandbox'
  condition: selection_browser and selection_args
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate FortiPAM usage
  - Developer/debugging activity
level: medium
tags:
  - attack.t1190
  - cve.2026-84388

YARA Rule

rule CVE_2026_84388_FortiPAM_UI_Redressing
{
    meta:
        description = "Heuristic detection of web content attempting UI redressing/framing abuse targeting FortiPAM Chrome Extension (CVE-2026-84388)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84388"
        cve = "CVE-2026-84388"

    strings:
        $fp1 = "fortipam" ascii nocase
        $fp2 = "FortiPAM" ascii nocase
        $iframe = "<iframe" ascii nocase
        $stylez = "position:absolute" ascii nocase
        $stylez2 = "z-index" ascii nocase
        $opacity = "opacity:0" ascii nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x6874 or true
        and any of ($fp1, $fp2)
        and 2 of ($iframe, $stylez, $stylez2, $opacity)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84388 Possible FortiPAM Chrome Extension UI Redressing Attempt"; flow:established,to_client; http.header; content:"FortiPAM"; nocase; http.response_body; content:"<iframe"; nocase; content:"z-index"; nocase; classtype:attempted-info-leak; reference:cve,2026-84388; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84388; sid:90084388; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ process where event.type == "start" and process.name : ("chrome.exe", "msedge.exe", "brave.exe") ]
  [ network where network.protocol == "http" and
      ( url.full : "*fortipam*" or http.request.body.content : "*fortipam*" ) and
      ( http.response.body.content : "*<iframe*" or http.response.body.content : "*z-index*" ) ]

Splunk SPL Query

index=proxy OR index=web OR index=endpoint
| eval hay = lower(_raw)
| where (match(hay, "fortipam") AND (match(hay, "<iframe") OR match(hay, "z-index") OR match(hay, "opacity:0")))
| stats count min(_time) as first_seen max(_time) as last_seen by src, dest, url, http_user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="fortipam,cve-2026-84388,web,">
  <rule id="100843" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>fortipam|FortiPAM</match>
    <regex type="pcre2">(?i)(iframe|z-index|opacity:\s*0)</regex>
    <description>CVE-2026-84388: Possible FortiPAM Chrome Extension UI redressing / frame abuse observed in HTTP activity</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84388,</group>
  </rule>
</group>

Detection caveat: because the precise exploitation trigger is undisclosed, the above rules are behavioural heuristics with a meaningful false-positive surface (legitimate FortiPAM use, benign iframes, debugging). They should be tuned to each environment and correlated with user-reported phishing or unexpected extension prompts rather than deployed as high-fidelity signatures.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Both the 8.0 branch and the 7.4 branch are reported as affected across all versions, and no vendor fixed version or advisory fix is identified in the available data.

1. Immediate mitigations

• Restrict use of the affected FortiPAM Chrome Extension versions (8.0, 7.4) where operationally feasible, and consult Fortinet directly for an interim fix or guidance, given no fixed version is published.
• Treat the extension as untrusted for handling any high-sensitivity data until a fix is confirmed; avoid performing privileged-access workflows in the same browser profile that loads untrusted web content.
• Reduce the UI:R precondition by hardening user behaviour and email/web security controls against phishing and malicious/water-holed pages, which are the likely delivery vector for a UI-redressing attack.
• Enforce browser extension allow-listing so that only approved extensions are loaded, and monitor for unexpected extension behaviour.
• Consider browser isolation / remote browsing for general web content when using FortiPAM in the same environment, to separate untrusted pages from the extension's context.

2. Patch / upgrade steps

• There is no identified patch. Monitor Fortinet's PSIRT advisories and the vendor support portal continuously for a fixed FortiPAM Chrome Extension release, and schedule upgrade as soon as a patched version covering 8.0 and 7.4 is published.
• Validate any vendor-provided fixed version against the affected branch list before closure; because the affected range spans all versions of two branches, confirm explicitly that the new release is outside the affected range.
• Re-verify after patching that the extension is updated across every managed endpoint, including remote and BYOD-adjacent profiles.

3. Long-term hardening

• Maintain a vulnerability-management process that tracks browser-extension findings — including client-side, UI-layer classes such as CWE-1021 — not just server-side CVEs; extension risk is frequently under-covered.
• Adopt Content-Security-Policy improvements, frame-ancestors restrictions, and frame-busting at the organisation's own web properties, and require vendors to document their anti-framing controls.
• Segment privileged-access usage from general browsing (dedicated hardened profiles or managed devices), reducing the reachability of client-side UI flaws to privileged contexts.
• Continue monitoring for exploit-in-the-wild evidence; currently there are none reported, no public PoC, and CISA KEV status is NO.

References

• NVD — CVE-2026-84388: https://nvd.nist.gov/vuln/detail/CVE-2026-84388
• CWE-1021 — Improper Restriction of Rendered UI Layers or Frames: https://cwe.mitre.org/data/definitions/1021.html
• Fortinet PSIRT Advisories (vendor advisory portal; monitor for CVE-2026-84388 guidance): https://www.fortiguard.com/psirt
• FIRST EPSS (CVE-2026-84388 not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84388 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign / exploit-in-the-wild status: No exploit code, no public PoC, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-84388 in the data available at the time of writing. No named threat actor has been attributed. Organisations should reassess if Fortinet publishes an advisory or if exploitation activity is reported.