Description

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T00:18:27.767Z",
  "pubdate": "2026-09-02T00:18:27.767Z",
  "executiveSummary": "A security vulnerability categorized as a 'Confused Deputy' exists within the CredentialProvider component of Google Chrome on Windows.\nThis flaw allows a remote attacker who has already successfully compromised the renderer process to exfiltrate sensitive information.\nThe vulnerability affects versions of Google Chrome on Windows prior to 152.0.7977.75.\nThe risk is characterized by Chromium as 'Low' severity, as it requires a preliminary exploit (renderer compromise) to facilitate the subsequent information leak.\nThe vulnerability leverages the elevated privileges or trust associated with the CredentialProvider to bypass security boundaries, potentially exposing credentials or sensitive system data that the renderer process should not typically access.\nSuccessful exploitation allows an attacker to broaden their footprint within the local system, moving beyond the restricted sandbox environment of the renderer process to access data managed by the CredentialProvider.",
  "technicalDetails": "The vulnerability resides in the CredentialProvider architecture, a component responsible for managing user identity and authentication artifacts within the Windows environment.\nThe root cause is a 'Confused Deputy' condition, where the higher-privileged CredentialProvider is coerced into performing an action on behalf of an untrusted or less-privileged requester—specifically, a compromised renderer process.\nUnder normal operating conditions, the browser sandbox strictly limits the capabilities of the renderer process to prevent arbitrary file system or system-level access. By exploiting a flaw in the inter-process communication (IPC) or logic flow of the CredentialProvider, a compromised renderer process can trick the provider into exposing data.\nThe attack flow begins with an attacker achieving arbitrary code execution within the renderer process, typically via a malicious HTML page that triggers a browser-side memory corruption or logic vulnerability.\nOnce the renderer process is compromised, the attacker interfaces with the CredentialProvider, likely through legitimate but insufficiently validated API calls or IPC messages. Because the CredentialProvider functions as an authority on the system, it may perform operations without verifying if the requesting process has sufficient authorization for the specific data requested.\nThe crafted HTML page acts as the vehicle for the payload, directing the renderer process to issue requests that cause the CredentialProvider to return sensitive information back to the renderer.\nOnce the renderer process receives this sensitive data, the attacker can transmit it to an external server under their control, completing the information exfiltration.\nThe attack does not require direct system-level authentication from the attacker; the requirement is fulfilled by the prior compromise of the renderer process. The exploit operates within the context of the user's logged-in session on Windows, leveraging the privileges granted to the browser's CredentialProvider interface.\nThe post-exploitation impact includes the potential leakage of user credentials, session tokens, or other sensitive authentication-related metadata that the CredentialProvider is tasked with protecting. This significantly undermines the browser's security model, as it allows for privilege escalation from a sandboxed renderer to the information space managed by the privileged provider component."
}