Preliminary research

Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab

James Arnott · Am I Being Pwned? · 9 September 2026

AI-collected research leads through 1 October 2026, including a bounded September review of selected social and community sources. Unranked, incomplete, not community-vetted, and subject to change.

Any website could make the FortiPAM extension trust its host, invoke an externally exposed launcher with a token that skipped validation, and click consent UI embedded in the page world. The resulting session could set a proxy, open a chosen tab and stream its screen recording.

Record

Researcher

James Arnott

Published by

Am I Being Pwned?

Date

9 September 2026

Topic

HTTP

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• browser-extension
• auth-bypass
• proxy
• info-leak
• phishing
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of James Arnott, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 1 October 2026.