A critical vulnerability in Fortinet’s FortiPAM Chrome extension could have allowed a malicious website to take control of privileged browser-session settings, set a browser proxy, open attacker-selected tabs, and exfiltrate screen recordings.
Tracked as CVE-2026-84388, the flaw received a CVSS score of 9.1 and affected an extension used by more than one million users.
Security researcher James Arnott disclosed the issue in Fortinet’s Privileged Access Management browser component, which helps broker privileged sessions by opening targets, injecting credentials, applying proxy policies, and recording user activity for audit purposes.
Fortinet FortiPAM Chrome Extension Flaw
Those features become high risk when an arbitrary website can influence the extension’s trusted server and session configuration.
The attack relied on a series of flaws that could be combined without compromising a legitimate FortiPAM server. The first issue involved a webRequest listener watching requests to the path https://*/api/v2/monitor/web-ui/state.
Whenever a request matched that pattern, the extension reportedly added the hostname to its trusted-server list. The logic did not validate the request initiator or confirm the request had completed successfully.
A malicious site could therefore request its own attacker-controlled domain, trigger the listener, and cause FortiPAM to consider that domain trusted.
The extension’s external messaging configuration amplified the problem. Its externally_connectable setting permitted messages from <all_urls>, allowing any website to communicate with the extension.
An attacker could use this access to submit a launcher message and identify their own infrastructure as the FortiPAM server from which the extension should obtain session data.
James Arnott stated that a token-validation weakness enabled the launch process. Instead of rejecting an access token that was not formatted as a JWT, the extension could skip validation.
This meant a malicious website could supply an invalid token, direct the extension to the attacker’s server, and have the extension retrieve an attacker-controlled privileged-session configuration.
FortiPAM displayed a consent dialog before launching a privileged session. However, the prompt was rendered in the main-world DOM, exposing it to scripts running on the same malicious website.
The attacker could locate the dialog’s allow button and programmatically click it, effectively approving the session without meaningful user interaction.
Once the session launched, the malicious configuration could direct the extension to modify browser proxy settings, open a new tab, and transmit a recording of that tab to an attacker-controlled endpoint.
This created a particularly serious phishing risk because a victim might only need to view sensitive content in the opened tab for it to be captured.
The recording capability posed the most immediate exposure concern. An attacker could potentially capture credentials, cloud-console data, API keys, internal dashboards, administrative interfaces, or other sensitive information displayed in the browser.
Proxy hijacking could also pose a risk, although HTTPS protections make direct man-in-the-middle interception harder unless an attacker can defeat certificate validation or force connections to insecure HTTP services. No public evidence of in-the-wild exploitation exists.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
