Description

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-06T22:16:55.930Z",
  "pubdate": "2026-08-06T22:16:55.930Z",
  "executiveSummary": "A race condition vulnerability exists within the CredentialProvider component of Google Chrome on Windows prior to version 151.0.7922.109.\nThe vulnerability allows a local attacker to execute a privilege escalation attack at the operating system level through the manipulation of a malicious file.\nThe flaw carries a high security severity rating according to Chromium security standards.\nSuccessful exploitation requires local access to the target Windows system and the ability to interact with the vulnerable CredentialProvider component.\nThe primary impact involves unauthorized elevation of privileges, potentially granting the attacker elevated access rights on the underlying operating system.\nRisk implications include full compromise of local system integrity, as attackers can leverage the elevated context to execute arbitrary commands, install persistent backdoors, or access restricted system resources.",
  "technicalDetails": "The vulnerability stems from a race condition flaw implemented within the CredentialProvider component of Google Chrome on Windows.\nThe affected product is Google Chrome on Windows, specifically impacting all versions prior to 151.0.7922.109.\nAuthentication requirements are minimal regarding network access, as the vulnerability is exploitable locally without requiring prior network exposure.\nPrivilege requirements dictate that the attacker must already possess local access to the Windows operating system to initiate the attack sequence.\nThe root cause involves asynchronous execution timing issues within the CredentialProvider when handling specific file operations, creating a race condition window.\nThe attack flow begins when a local attacker places a specially crafted malicious file in a location processed by the vulnerable CredentialProvider component.\nDuring execution, the CredentialProvider improperly handles concurrent access or state verification associated with the malicious file.\nBy timing resource access precisely, the attacker wins the race condition, causing the component to perform operations in an unintended security context.\nThis improper handling bypasses standard access control enforcement mechanisms embedded within the credential management workflow.\nPost-exploitation impact transitions from standard user privileges to OS-level privilege escalation, granting the attacker high-integrity execution capabilities on the host system."
}