EUVD-2026-61226
GHSA-gpf6-hggm-45pw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local access required (AV:L); sandbox escape implies scope change (S:C, not S:U); unprivileged junction creation on Windows supports PR:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
AnalysisAI
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Windows system running Google Chrome prior to version 151.0.7922.169. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) presents a notable internal inconsistency: S:U (Unchanged scope) conflicts with the description's explicit claim of code execution 'outside the sandbox,' which is by definition a scope change from the sandboxed Chrome process to a higher-privilege execution context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a Windows workstation creates a malicious directory junction or symbolic link at a filesystem path that Chrome's CredentialProvider is expected to access during a credential operation. When Chrome processes the link - for example, during a login or credential sync event - the CredentialProvider follows the attacker-crafted link to a controlled path, allowing the attacker to stage a file that gets executed in the context of a higher-privilege Chrome process operating outside the sandbox. … |
| Remediation | The primary fix is to upgrade Google Chrome on Windows to version 151.0.7922.169 or later, which Google has released as a stable channel update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and prioritize all Windows systems running Chrome versions prior to 151.0.7922.169, particularly administrative and high-risk user accounts, and initiate manual updates on isolated test systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today