Security Alert: Vulnerability Found in Fortinet FortiPAM Chrome Extension
In a significant cybersecurity concern, a critical vulnerability has been unearthed within the Fortinet FortiPAM Chrome extension. This flaw, tracked as CVE-2026-84388 and awarded a high CVSS score of 9.1, poses a substantial risk by potentially enabling malicious websites to manipulate browser proxy settings, open tabs at the attacker’s discretion, and record user activities within those tabs. Given the sensitive nature of data involved, including credentials and API keys, the implications of this vulnerability are severe.
The FortiPAM extension is intended to facilitate privileged access sessions by connecting to a FortiPAM server. This connection allows it to initiate target systems, inject credentials, enforce specific proxy policies, and optionally carry out activity recordings for auditing purposes. Unfortunately, the structure of this extension exposes users to risks that could compromise sensitive information.
A technical disclosure by "Am I Being Pwned" has shed light on the nature of this vulnerability, attributing it primarily to a flaw in the trust mechanism employed by the extension. The issue arises from a webRequest listener that is designed to monitor requests made to the /api/v2/monitor/web-ui/state endpoint. The vulnerability allows the requested hostname to be added to a list of trusted servers without the necessary verification of the request initiator or confirmation that the request was completed successfully. This lax security measure means an attacker could easily trick a victim’s browser into considering a domain under their control as a legitimate FortiPAM server.
Additionally, another critical component of this vulnerability is its allowance for unauthenticated session launching. The extension’s message interface is often exposed through an externally connectable setting that permits any site to send runtime messages. This security oversight facilitates arbitrary sites to communicate directly with the extension, raising alarm bells for users and network administrators alike.
The vulnerability extends further with a flawed token-handling mechanism, which accepts non-JWT values and fails to validate them adequately. This deficiency means that a malicious web page could issue a launcher request, complete with a fabricated access token and session parameters. Subsequently, the extension would retrieve the complete session configuration from the origin dictated by the attacker, empowering them to adjust proxy settings, select the destination tab, and take control of the recording process.
Moreover, researchers uncovered a means to bypass the extension’s consent control. The permissions dialog appears within the main-world DOM of the page, enabling hostile JavaScript to locate the modal’s shadow root and automatically click the "Allow" button. When consent is granted this way, attackers can open webpages of their choice and send recordings directly to their infrastructure. This scenario creates a straightforward phishing opportunity: as victims interact with the tab, sensitive information can be captured and exploited.
In response to the alarming discovery, Fortinet issued an advisory (FG-IR-26-168) following the initial report received on July 17, 2023. They took prompt action, releasing a fix on August 1, 2023. However, it is crucial to note that no confirmed cases of exploitation in the wild have yet been reported.
While HTTPS can complicate proxy-based interception—since attackers must tackle certificate and transport protections—the tab-recording capability remains a pressing issue. It could directly unveil sensitive information visible during a browser session, increasing the urgency for users to act.
Organizations utilizing the FortiPAM Chrome extension are strongly urged to update their deployments without delay. They should identify users operating the affected versions and thoroughly scrutinize privileged session logs for any unexplained launches, unauthorized proxy changes, or recordings sent to unapproved endpoints. Furthermore, it is imperative to ensure that all managed browsers receive the necessary patches and remediations, thereby safeguarding sensitive data from potential breaches.
In a realm where cybersecurity threats are ever-evolving, organizations are reminded of the significance of maintaining updated security measures and protocols. One essential step is to keep Security Operations Centers (SOCs) informed on active threats, including malware and phishing attacks. For organizations keen on proactive threat management, platforms such as ANYRUN can facilitate early detection and incident prevention, ensuring the integrity of sensitive data continues to be protected in an increasingly complex digital landscape.