Fortinet FortiPAM Chrome Extension Flaw Lets Any Site Hijack Proxy and Record Tabs

The FortiPAM Chrome extension vulnerability (CVE‑2026‑84388) allows any website to change the browser's proxy, open a new tab and stream its screen to an attacker, affecting more than one million users and exposing privileged sessions to theft.

Who is affected by this FortiPAM Chrome flaw?

Anyone who has installed the FortiPAM extension for privileged access management is at risk. The extension is deployed in enterprises worldwide and has crossed the one‑million‑user threshold, according to the disclosure discussed by researchers.

Typical victims include security‑conscious IT admins, DevOps engineers, and any employee who uses the extension to access privileged systems via a browser‑based console.

How does the vulnerability enable a malicious site to hijack a browser session?

The extension exposes a JavaScript API that trusts content from the FortiPAM server. A crafted website can invoke this API to set the browser's proxy for the current session, effectively routing all traffic through an attacker‑controlled server.

Once the proxy is under attacker control, the site can open a new tab, load any URL, and capture a live video stream of the tab's contents. The stream is then uploaded to the attacker’s server, giving them a real‑time view of any credential entry or confidential data displayed.

Why does proxy manipulation matter in a privileged‑access context?

Changing the proxy redirects all outbound traffic, including authentication requests to internal services. An attacker can therefore perform man‑in‑the‑middle attacks, capture tokens, or exfiltrate data without the user noticing.

Because the extension is meant to enforce security policies, its misuse flips the intended protection into a powerful espionage tool.

What are the practical steps to mitigate this risk today?

Immediately remove or disable the FortiPAM Chrome extension on all endpoints until a patched version is released. Organizations should also audit browser extensions via centralized management tools to enforce a whitelist.

Network teams can block outbound proxy configuration changes from browsers by applying Group Policy or using endpoint detection and response (EDR) solutions that monitor proxy‑related registry keys and Chrome policies.

How can GetKhojo help enterprises detect and reduce this attack surface?

GetKhojo’s continuous scanning platform maps every installed browser extension across your fleet, flagging those with elevated privileges like FortiPAM. Our dashboards highlight extensions that can modify proxy settings or access media devices, allowing rapid remediation.

In addition, GetKhojo provides privacy‑hygiene reports that show which sites have been granted elevated permissions, helping security teams tighten content‑security policies before an attacker can exploit them.

What does this vulnerability teach about privileged‑access tooling?

Even tools designed to harden access can become vectors if they expose overly permissive APIs to the browser environment. Developers must enforce strict origin checks and limit the scope of privileged operations.

Enterprises should adopt a defense‑in‑depth approach: combine least‑privilege extension policies, network segmentation, and real‑time monitoring of privileged session activity.

What this means for you

If you or your organization rely on FortiPAM’s Chrome extension, treat this as a high‑severity incident. Disable the extension, verify that no unauthorized proxy changes have occurred, and scan for lingering screen‑recording traffic. Use GetKhojo to maintain visibility over browser extensions and enforce strict permission baselines to prevent similar exploits in the future.

Frequently asked questions

Can the FortiPAM Chrome extension vulnerability be exploited without user interaction?

Yes. A malicious website can automatically invoke the vulnerable API when visited, changing the proxy and streaming a tab without any additional clicks from the user.

Is there a patch available for CVE‑2026‑84388?

As of the latest reports, Fortinet has not yet released a patched version. The recommended mitigation is to uninstall or disable the extension until an official fix is provided.

How can I detect if my browser proxy has been tampered with?

Check the browser’s proxy settings in Chrome’s system settings or use endpoint monitoring tools that alert on changes to proxy configuration keys or network traffic redirection.

Do other browsers have similar risks with privileged extensions?

Any browser that allows extensions to modify network settings or capture screen content can be vulnerable if the extension’s API is not properly restricted. Regular extension audits are essential.

What steps should an organization take after discovering a compromised FortiPAM session?

Revoke any active privileged tokens, rotate credentials, conduct a forensic review of network logs for proxy misuse, and enforce multi‑factor authentication for privileged accounts.