EUVD-2026-30461
GHSA-p5mw-jhxg-h7q8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker must first control the renderer (modeled as PR:L) and needs a crafted page plus user browsing (AC:H, UI:R); full local privilege-escalation impact within the browser yields C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Privilege escalation in Google Chrome's Passwords component on Windows (versions prior to 148.0.7778.168) lets a remote attacker who has already compromised the renderer process escape its privilege boundary via a crafted HTML page. Rated High by Chromium and CVSS 7.5, it is a second-stage bug used to extend an existing renderer foothold rather than an initial-access vector. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%, 20th percentile), consistent with SSVC marking exploitation as none.
Technical ContextAI
The flaw sits in Chrome's Passwords subsystem, which stores and autofills saved credentials and enforces origin/policy checks before releasing them to web content. The CWE-862 (Missing Authorization) classification indicates the code path fails to fully enforce the intended policy boundary, so an actor executing inside the renderer (Chrome's low-privilege, sandboxed web-content process) can reach functionality or data that should be gated to the more-privileged browser process. CPE cpe:2.3:a:google:chrome pins the affected software to the Google Chrome application; the Windows-specific scoping in the description suggests the weakness is in platform-specific policy enforcement rather than the cross-platform password store as a whole. Because Chromium's security model assumes the renderer can be fully compromised by malicious web content, insufficient authorization at this trust boundary is treated as a meaningful escalation primitive.
RemediationAI
Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the Stable channel, then fully relaunch the browser so the new binary takes effect (Chrome staged updates do not apply until restart). In managed environments, push the update through your enterprise update policy or GPO and verify the effective version on endpoints. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. As a compensating control until patching completes, reduce renderer-compromise exposure by restricting untrusted browsing (enforce Site Isolation, which is on by default, and consider blocking high-risk sites), since this bug only becomes reachable after a renderer is compromised - trade-off is that these controls reduce but do not eliminate the initial-access step. There is no need to disable the password manager as a standalone workaround, as no such vendor-recommended mitigation is documented; patching is the reliable fix.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today