EUVD-2026-40811
GHSA-p4r8-qhgc-gwhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local unprivileged foothold
-
DeliveryStage malicious file for CredentialProvider
-
ExploitInduce processing via user interaction
-
ExecutionTrigger improper privilege handling (CWE-269)
-
ImpactEscalate to OS-level SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the Windows host and user interaction (CVSS UI:R) - specifically the processing of an attacker-supplied malicious file by Chrome's CredentialProvider component, meaning the Google Credential Provider for Windows / CredentialProvider integration must be present and in use on the target. Limiting factors: the attack is not remote (AV:L), cannot succeed without the required interaction/file-processing step, is confined to the Windows platform, and applies only to Chrome versions prior to 150.0.7871.47. Environments that do not deploy the Chrome CredentialProvider/GCPW functionality face a substantially reduced attack surface for this specific issue. |
| Impact | The signals are mixed and should be weighed carefully. CVSS 3.1 is 7.8 (High) driven by C:H/I:H/A:H, but the vector is local (AV:L) and requires user interaction (UI:R), so this is not a remotely-triggerable, wormable issue - it is a local escalation useful as a second stage after an attacker already has some foothold or can entice a user to open a malicious file. Google's own Chromium severity rating is 'Low,' which conflicts with the 7.8 CVSS and suggests limited practical exploitability or narrow preconditions; this discrepancy should be noted rather than resolved as fact. EPSS is 0.11% (2nd percentile) and the CVE is NOT in CISA KEV, indicating no evidence of active exploitation and low near-term probability. No POC is referenced. Net assessment: a real but low-urgency issue for most environments - patch in normal cycles; prioritize higher only where GCPW/CredentialProvider is deployed and local-attacker threat models matter. |
| Exploit ScenarioDerived | An attacker who already has a local, unprivileged presence on a Windows host (or who convinces a logged-in user to open a specially crafted file) places a malicious file that Chrome's CredentialProvider processes improperly, causing the privileged component to perform an operation that elevates the attacker to OS-level privileges. This turns a limited user foothold into full SYSTEM/administrative control. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
OS-level privilege escalation in Google Chrome for Windows before 150.0.7871.47 lets a local attacker leverage an inappropriate implementation in the CredentialProvider component to elevate privileges via a malicious file. Exploitation requires local access plus user interaction (UI:R), and though Google rated the Chromium security severity 'Low', the CVSS 3.1 base score is 7.8 (High) due to full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low at 0.11% (2nd percentile).
RemediationAI
Vendor-released patch: update Google Chrome on Windows to 150.0.7871.47 or later, as delivered via the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); restart the browser to ensure the update is applied since Chrome staged updates only take effect after relaunch. Where the Google Credential Provider for Windows (GCPW) is deployed, ensure the corresponding managed installation is updated through your enterprise distribution channel. Because the vector is local and requires user interaction with a malicious file, effective compensating controls until patching include restricting local/interactive logon and administrative rights on affected hosts, applying application-allowlisting to block untrusted files from being opened, and reviewing whether the CredentialProvider/GCPW integration is actually required on a given endpoint and removing it if not - with the trade-off that removing GCPW disables Google-account-based Windows sign-in. No manual configuration workaround is published by the vendor; the fix is the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's CredentialProvider, the Windows credential-provider integration (associated with Google Credential Provider for Windows / GCPW) that plugs into the Windows logon/authentication subsystem to enable Google-account-based sign-in and credential handling. The root cause is classified as CWE-269 (Improper Privilege Management): the component fails to correctly constrain or validate privileges/trust when handling a file, allowing an operation to run with more privilege than intended. Because credential providers execute in a highly privileged context within the Windows authentication stack, a mishandled or attacker-supplied ('malicious') file processed by this component can cross a trust boundary and yield OS-level (SYSTEM/administrative) privileges rather than remaining confined to the browser's sandboxed user context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector with required user interaction and no prior privilege (AV:L/PR:N/UI:R); successful OS privilege escalation yields full C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Windows versions before 150.0.7871.47 contain a local privilege escalation vulnerability enabling full system compromise through user interaction with a malicious file. No public exploit has been identified, but successful exploitation would grant administrative privileges and complete access to organizational data. Patching is required to eliminate this escalation pathway.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB