Uncontrolled search path manipulation in the CredentialProvider component of Google Chrome on Windows allows a local attacker to execute arbitrary code outside the browser sandbox. The flaw is a classic path‑bypass vulnerability that can enable an attacker who can run a local program to load and run malicious DLLs or executables. The impact includes potential compromise of the host system, elevated privileges, and persistence beyond the browser environment.

Google Chrome Windows users running any version before 155.0.8059.39 are affected. The vulnerability is present only in builds released prior to that version and has been addressed in later stable channel releases.

The exploit requires local user access and the ability to launch a program on the target machine. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 8.6 indicates a high severity, and because the attack vector is local, the risk is high; however, local code execution can be leveraged for further privilege escalation if the local user is privileged or if additional Windows defenses are bypassed.