EUVD-2026-54272
GHSA-h23f-fw55-m43w
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local race condition in a pre-authentication Windows component justifies PR:N and AV:L; AC:H reflects timing precision required; full CIA impact consistent with OS-level escalation.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
AnalysisAI
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Technical ContextAI
CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes the root cause: two execution paths compete over a shared resource without adequate synchronization, enabling a time-of-check-time-of-use (TOCTOU) or similar timing exploit. The affected component is Chrome's CredentialProvider, a Windows-specific subsystem that integrates with the Windows Credential Provider interface - the plugin layer invoked during the Windows logon sequence to offer alternative authentication options (e.g., Google account sign-in to Windows). Because credential providers interact with the Windows Local Security Authority (LSA) and Winlogon at a privileged layer, a race condition within this component can be leveraged to achieve OS-level privilege escalation rather than just browser-level access. The EUVD entry EUVD-2026-54272 confirms the affected version range as Chrome below 151.0.7922.109 on Windows.
RemediationAI
The primary fix is to update Google Chrome for Windows to version 151.0.7922.109 or later, released via the stable channel. The vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html confirms patch availability. Chrome's auto-update mechanism should apply this silently in most managed and consumer environments; administrators should verify fleet compliance via policy dashboards. As a compensating control where immediate patching is not possible, disabling or unregistering the Google Credential Provider for Windows (if the feature is not operationally required) removes the vulnerable attack surface - note this eliminates the ability to sign into Windows with Google credentials. Restricting physical access to affected endpoints limits exposure given the local attack vector. No workaround fully substitutes for the patch given the OS-level impact of exploitation.
Same weakness CWE-362 – Race Condition
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today