Description

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-18T21:18:27.727Z",
  "pubdate": "2026-08-18T21:18:27.727Z",
  "executiveSummary": "A privilege escalation and arbitrary code execution vulnerability exists within the CredentialProvider component of Google Chrome on Windows prior to version 151.0.7922.169.\nThe vulnerability manifests as an insecure link-following flaw that enables a local attacker to bypass sandbox restrictions and execute arbitrary code outside the sandbox context by leveraging a local program.\nThe affected product is Google Chrome on the Windows operating system, specifically versions preceding 151.0.7922.169.\nThe risk implications are significant, as successful exploitation allows local threat actors to elevate privileges beyond the restricted Chromium sandbox boundaries and execute arbitrary code on the underlying host operating system.\nAttacker capabilities require local access to the target Windows system.\nExploitation requirements include the presence of a vulnerable Google Chrome installation prior to version 151.0.7922.169 and the ability to interact locally with the CredentialProvider component to trigger insecure link-following behavior.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper handling of symbolic links, junctions, or file paths within the CredentialProvider component of Google Chrome on Windows.\nThe vulnerable component is the CredentialProvider module responsible for handling authentication credential management and related integrations within the Windows OS environment.\nAffected software versions include Google Chrome on Windows prior to 151.0.7922.169.\nAuthentication requirements are minimal, as the attack is driven locally; network exposure is not required since the attack vector is entirely local.\nPrivilege requirements dictate that the attacker must already possess local execution capabilities on the host system to initiate the attack chain.\nExploitation occurs when an attacker manipulates file system objects or handles linked paths processed by the CredentialProvider.\nThe attack flow proceeds as follows: First, the attacker establishes local access on the Windows system. Second, the attacker interacts with or triggers the vulnerable CredentialProvider component under conditions where it follows links to unintended local targets. Third, by exploiting this improper link-following behavior, the attacker forces the component to interact with a specific local program.\nBecause the CredentialProvider operates with elevated integrity or outside the strict confines of the standard browser isolation mechanisms, successfully steering its behavior allows the attacker to launch or interact with a local program in an unintended manner.\nPayload behavior and post-exploitation impact involve breaking out of the Chromium security sandbox entirely, leading to the execution of arbitrary code with the privileges of the invoked local program or the process executing the credential provider routine, thereby achieving local privilege escalation and persistent host compromise."
}