Executive Summary: Privileged Vault Compromise via Browser Extension

Fortinet's Product Security Incident Response Team (PSIRT) has released an emergency security advisory, FG-IR-26-168, announcing the discovery of a maximum-criticality flaw tracked as CVE-2026-84388. The vulnerability impacts FortiPAM (Fortinet Privileged Access Management), the centralized secrets management appliance and zero-trust administrative gateway used by Fortune 500 enterprises, government agencies, and critical infrastructure operators to secure domain administrator credentials, root SSH keys, and core network switches.

Rated with a CVSS v3.1 base score of 9.6 (Critical), the defect is classified under CWE-1021: Improper Restriction of Rendered UI Layers or Frames alongside CWE-287: Improper Authentication. The vulnerability enables unauthenticated remote adversaries to hijack active PAM sessions, inject arbitrary command proxies into the administrator's browser, and extract enterprise credentials stored inside the FortiPAM vault without triggering traditional multi-factor authentication (MFA) prompts.

Attack Mechanics: Extension IPC & Proxy Redirection

The FortiPAM ecosystem employs the Fortinet Privileged Access Agent Chrome Extension to streamline session launching, auto-fill administrative credentials into browser-based management consoles, and facilitate video recording of privileged user sessions.

The attack vector operates through a breakdown in inter-process communication (IPC) and frame validation:

  1. Missing Origin Validation: The extension's content scripts and background service workers failed to validate the origin of cross-window postMessage events and iframe nesting requests.
  2. Malicious Webpage Lure: An administrative user logged into their corporate FortiPAM environment is enticed to visit an external website (via phishing, a forum link, or watering-hole compromise).
  3. Extension Hijacking: The attacker's webpage sends crafted messages to the extension's message listener. Because the extension lacked proper origin checks, it accepted commands from any website.
  4. Traffic Proxy Redirection: The exploit instructs the extension to reconfigure its internal proxy routing, directing all administrative traffic through an attacker-controlled proxy server. The adversary captures cleartext credentials, session cookies, and authentication tokens destined for enterprise firewalls and domain controllers.

Affected Software Versions & Upgrade Matrix

Product Component Vulnerable Releases Secure Upgrade Target Required Action
FortiPAM Server (Appliance) Versions 1.9.0 ≤ 1.9.0
Versions 1.8.0 ≤ 1.8.3		 FortiPAM 1.9.1 or later
FortiPAM 1.8.4 or later		 Apply firmware patch via FortiOS GUI or CLI
FortiPAM Chrome Extension Extension Version 8.0 (All builds)
Extension Version 7.4 (All builds)		 Version 8.0.1.123 or higher Force enterprise Chrome policy extension update

SOC Detection & Threat Hunting Telemetry

Security teams should immediately search proxy and firewall logs for anomalous connections initiated by administrative workstations executing the FortiPAM browser extension.

1. Chrome Extension Policy Audit (Registry / GPO)

# Check installed extension version via PowerShell
Get-ItemProperty -Path "HKCU:\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings" -ErrorAction SilentlyContinue

# Verify Chrome enterprise force-installed version
Get-ChildItem -Path "C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\*" | 
  Where-Object { $_.Name -like "*fortinet*" -or $_.Name -like "*pam*" } | 
  Select-Object FullName, CreationTime

2. FortiPAM Syslog Event Query

# Look for anomalous proxy configuration changes and session resets in FortiPAM log stream
log.action="proxy_change" AND log.user_level="admin" AND log.status="failed"

Remediation Playbook

  1. Upgrade FortiPAM Server Immediately: Apply the patched firmware release via the FortiPAM management interface: 
    # FortiPAM CLI Firmware Upgrade Command
execute restore image tftp FortiPAM_VM64-v1.9.1-build0312-FORTINET.out 192.168.10.50
  2. Force Browser Extension Updates via Google Workspace / Intune: In the Google Admin Console, navigate to Devices > Chrome > Apps & extensions and update the minimal version restriction for the FortiPAM extension to 8.0.1.123.
  3. Rotate High-Value Administrative Credentials: As a defense-in-depth measure, rotate passwords and private keys for all systems accessed by privileged administrators over the past 30 days.