Google Chrome EUVD-2026-61226

Exploitation requires local access to a Windows system running Google Chrome prior to version 151.0.7922.169. The vulnerability is confined to Windows platforms only - the CVE description and affected product data do not indicate impact on Chrome for Linux or macOS. The attacker must be able to create filesystem junctions or symbolic links on the target system; on Windows, unprivileged users can create directory junctions without the SeCreateSymbolicLinkPrivilege, making this accessible to standard local user accounts. The CredentialProvider component must be invoked, which occurs during Chrome's credential handling operations - this is part of Chrome's standard Windows deployment and does not require a non-default configuration. The PR:N rating in the official CVSS vector indicates no special user privilege level is required beyond local logon access. What limits exploitation: physical or remote desktop access to the target system is required; the attack cannot be triggered remotely; SSVC Automatable: no confirms this cannot be scripted for mass delivery; the attack window depends on CredentialProvider invocation timing.

The official CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) presents a notable internal inconsistency: S:U (Unchanged scope) conflicts with the description's explicit claim of code execution 'outside the sandbox,' which is by definition a scope change from the sandboxed Chrome process to a higher-privilege execution context. An independent assessment would suggest S:C is more appropriate, which would raise the effective severity further. SSVC signals (Exploitation: none, Automatable: no, Technical Impact: total) partially temper urgency - the 'Automatable: no' rating confirms this requires interactive local presence and cannot be mass-exploited remotely, aligning with AV:L. EPSS data was not provided. KEV status is negative, and no POC has been identified. Despite the reassuring exploitation-none SSVC signal, the 'Technical Impact: total' rating and sandbox escape scope mean a successful local exploit would fully compromise the Chrome process boundary. Real-world priority is moderate for most enterprise environments - local access is required, reducing attack surface significantly - but elevated for shared workstation environments, kiosks, or VDI deployments where untrusted local users are a realistic threat model.

A local user on a Windows workstation creates a malicious directory junction or symbolic link at a filesystem path that Chrome's CredentialProvider is expected to access during a credential operation. When Chrome processes the link - for example, during a login or credential sync event - the CredentialProvider follows the attacker-crafted link to a controlled path, allowing the attacker to stage a file that gets executed in the context of a higher-privilege Chrome process operating outside the sandbox. No public proof-of-concept code has been identified at the time of this analysis.