EUVD-2026-40811
GHSA-p4r8-qhgc-gwhm
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector with required user interaction and no prior privilege (AV:L/PR:N/UI:R); successful OS privilege escalation yields full C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)
AnalysisAI
OS-level privilege escalation in Google Chrome for Windows before 150.0.7871.47 lets a local attacker leverage an inappropriate implementation in the CredentialProvider component to elevate privileges via a malicious file. Exploitation requires local access plus user interaction (UI:R), and though Google rated the Chromium security severity 'Low', the CVSS 3.1 base score is 7.8 (High) due to full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low at 0.11% (2nd percentile).
Technical ContextAI
The flaw resides in Chrome's CredentialProvider, the Windows credential-provider integration (associated with Google Credential Provider for Windows / GCPW) that plugs into the Windows logon/authentication subsystem to enable Google-account-based sign-in and credential handling. The root cause is classified as CWE-269 (Improper Privilege Management): the component fails to correctly constrain or validate privileges/trust when handling a file, allowing an operation to run with more privilege than intended. Because credential providers execute in a highly privileged context within the Windows authentication stack, a mishandled or attacker-supplied ('malicious') file processed by this component can cross a trust boundary and yield OS-level (SYSTEM/administrative) privileges rather than remaining confined to the browser's sandboxed user context.
RemediationAI
Vendor-released patch: update Google Chrome on Windows to 150.0.7871.47 or later, as delivered via the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); restart the browser to ensure the update is applied since Chrome staged updates only take effect after relaunch. Where the Google Credential Provider for Windows (GCPW) is deployed, ensure the corresponding managed installation is updated through your enterprise distribution channel. Because the vector is local and requires user interaction with a malicious file, effective compensating controls until patching include restricting local/interactive logon and administrative rights on affected hosts, applying application-allowlisting to block untrusted files from being opened, and reviewing whether the CredentialProvider/GCPW integration is actually required on a given endpoint and removing it if not - with the trade-off that removing GCPW disables Google-account-based Windows sign-in. No manual configuration workaround is published by the vendor; the fix is the version upgrade.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today