Google Chrome EUVD-2026-54272

Exploitation requires local access to a Windows system running Google Chrome prior to version 151.0.7922.109 with the Chrome CredentialProvider component active. The attacker must be able to place or interact with a malicious file on the target system. The CVSS PR:N rating indicates no prior Windows account privileges are required, suggesting exploitation may be possible at the pre-authentication stage (e.g., the Windows login screen where credential providers are loaded). The AC:H rating reflects the inherent difficulty of reliably winning a race condition, requiring precise timing that limits automated or mass exploitation. Exploitation is Windows-only; Chrome on macOS and Linux is not affected by this component. The SSVC rating of 'not automatable' further confirms that scripted or wormable exploitation is not currently feasible.

The CVSS 7.4 score (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the central tension in this vulnerability: while CIA impact is total and no prior privileges are required (PR:N), the local attack vector and high attack complexity (AC:H, reflecting the timing precision needed to win the race) meaningfully constrain practical exploitation. The SSVC framework corroborates this - exploitation status is 'none' and the attack is rated 'not automatable,' consistent with the manual precision race conditions typically demand. Despite these limiting factors, technical impact is rated 'total,' meaning a successful exploitation achieves full OS compromise. No EPSS score is present in the provided data. No CISA KEV listing exists, and no public proof-of-concept has been identified at time of analysis. Real-world risk is therefore moderate to high for machines where local access by untrusted parties is possible (shared workstations, kiosk terminals, enterprise endpoints with physical access risks), but lower in environments with strong physical access controls. The PR:N rating is notable - it suggests exploitation may be possible without any existing Windows account, potentially at the pre-login credential provider screen, which elevates concern for physically accessible endpoints.

A local attacker with physical or remote desktop access to a Windows machine running a vulnerable Chrome build places a malicious file and triggers a race condition in the CredentialProvider component - potentially at the Windows login screen where the provider is invoked. By precisely timing the interaction to win the race, the attacker subverts the privileged credential handling path and escalates to OS-level privileges, gaining SYSTEM or administrator access without needing pre-existing Windows credentials. No public exploit code for this specific vulnerability has been identified at time of analysis.