The FortiPAM Chrome Extension contains an improper restriction of rendered UI layers or frames that can lead to information disclosure. The flaw allows an attacker to obtain data from layers or frames that should be inaccessible, representing a breach of confidentiality. This weakness is identified as CWE-1021, which reflects an improper restriction of view.

Fortinet FortiPAM Chrome Extension, all versions of 8.0 and 7.4, including the specific 8.0.1 release indicated by the CPE.

The CVSS score of 9.1 indicates a critical severity, and the vulnerability is not yet listed in the CISA KEV catalog. The vulnerability can be triggered remotely without authentication, meaning any user visiting a malicious site or loaded content that interacts with the extension could cause the disclosure. Attackers would need only to influence the web page content visible to the Chrome extension, which can then read restricted UI layers or frames. The high severity and unauthenticated nature of the exploit point to an urgent need for remediation.