shadowforge-cyber/cve-2026-84388-pocImproper Restriction of Rendered UI Layers or Frames (CWE-1021)
This repo contains a proof-of-concept exploit for CVE-2026-84388 (Improper Restriction of Rendered UI Layers or Frames, CWE-1021). The vulnerability in Fortinet FortiPAM Chrome Extension (v7.4–8.0) allows any visited website to bypass UI layer restrictions, force the extension to render attacker-controlled frames/tabs, set the browser proxy, and screen-capture/steam sensitive data (credentials, sessions, etc.) back to the attacker.
Impact: Unauthenticated remote attacker gains full visibility into the victim’s FortiPAM interface without interaction.
Contact us for private access: [email protected]
Missing x-frame-options: DENY header and insufficient CSP frame-ancestors on the extension’s privileged popup/iframe pages. Any site can inject ``, forcing the extension to render attacker-controlled content inside its own sandboxed context and expose internal APIs for proxy injection + tab screenshot streaming.
# One-liner payload for any site
Run the relay server and open your target page in the victim’s browser. Done.
Report & PoC: ShadowForge Cyber