FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs

A critical vulnerability has been identified in the Fortinet FortiPAM Chrome extension that could allow a malicious website to manipulate browser proxy settings, open tabs at the attacker’s discretion, and record activity within those tabs.

This issue, tracked as CVE-2026-84388 and rated with a CVSS score of 9.1, impacts an extension that facilitates privileged access sessions, putting sensitive credentials, API keys, and other data displayed in the affected tabs at risk.

FortiPAM Chrome Extension Vulnerability

The extension typically gets its configuration from a FortiPAM server, which launches target systems, injects credentials, enforces proxy policies, and optionally records activity for auditing.

According to the technical disclosure from Am I Being Pwned, the vulnerability stems from a flaw in the trust mechanism. Specifically, a webRequest listener that monitors requests to /api/v2/monitor/web-ui/state adds the requested hostname to a list of trusted servers without verifying the request initiator or confirming the request completed successfully.

As a result, an attacker could persuade the victim’s browser to regard a domain under the attacker’s control as a legitimate FortiPAM server.

Another issue allows for unauthenticated session launching. The extension’s message interface is exposed through an externally_connectable setting of <all_urls>, permitting arbitrary sites to send runtime messages.

The token-handling mechanism accepts non-JWT values and skips validation instead of rejecting them outright. This means a malicious page could issue a launcher request with its own origin, a fabricated access token, and session parameters.

The extension would then retrieve the full session configuration from that origin, letting the attacker manipulate proxy settings, select the destination tab, and control the recording process.

Researchers also discovered that the extension’s consent control can be bypassed. The permission dialog appears within the page’s main-world DOM, allowing hostile JavaScript to locate the modal’s shadow root and programmatically click the “Allow” button.

When consent is automatically granted this way, the attacker can open a page of their choice and send screen recordings to their own infrastructure. This creates a straightforward phishing opportunity: a victim only needs to view sensitive information in the tab the attacker opens for it to be captured.

Fortinet issued an advisory (FG-IR-26-168) after receiving the report on July 17, with a fix released on August 1. No confirmed cases of exploitation in the wild have been reported.

Although HTTPS complicates proxy-based interception, because an attacker still has to deal with certificate and transport protections, the tab-recording capability could directly expose sensitive information displayed during a browser session.

Organizations should urgently update their FortiPAM Chrome extension deployments, identify users running the affected versions, and review privileged session logs for unexpected launches, proxy changes, or recordings sent to unapproved endpoints. Also verify that every managed browser has received the necessary remediation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.