Google Chrome CVE-2026-84329

Exploitation requires two sequential conditions: (1) the attacker must have already achieved compromise of the Chrome renderer process via a separate vulnerability - this is explicitly stated in the description and captured by AC:H in the CVSS vector; and (2) the user must interact with a crafted HTML page (UI:R). The vulnerability is Windows-platform-specific; Chrome on macOS or Linux is not affected per the description scope. No authentication is required from the attacker's perspective (PR:N), but the renderer compromise prerequisite is a significant technical barrier. Exploitation is limited to confidentiality impact - no integrity or availability impact is indicated. The CredentialProvider integration must be present and active, which is the default configuration for Chrome on Windows.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a constrained but serious confidentiality impact. The AC:H metric is the critical signal: exploitation requires the attacker to have already achieved renderer process compromise, which itself demands a separate, often high-complexity vulnerability. Chromium's internal 'Low' severity designation aligns with this - the confused deputy step is a chained, post-exploitation technique rather than an entry-point flaw. No EPSS data is provided in the source intelligence; no KEV listing exists; no public POC has been identified. Real-world risk is moderate-to-low for most environments: a threat actor capable of chaining a renderer RCE with this confused deputy step is sophisticated, and the credential leakage impact is meaningful but bounded by Chrome's sandbox context. Organizations handling high-value credentials in Chrome profiles on Windows workstations should prioritize patching nonetheless.

An attacker first exploits a separate renderer RCE vulnerability - for example, a V8 JavaScript engine flaw - by luring a Windows user to a crafted HTML page. With renderer process control established, the attacker then abuses the confused deputy relationship in Chrome's CredentialProvider, causing it to relay stored credential data (passwords, tokens) back to attacker-controlled code within the renderer. This two-stage chain is within reach of sophisticated threat actors targeting credential theft on managed Windows endpoints.