Google Chrome on Windows contains a missing authorization check in the CredentialProvider component in versions prior to 155.0.8059.39. This flaw allows a local attacker with physical access to read sensitive credentials stored by the browser. The weakness is a classic missing authorization (CWE-862) that results in unauthorized disclosure of protected data.

Google Chrome installations on Windows that are older than version 155.0.8059.39 are affected. Users running these versions should verify the installed build number and plan to update if a patch is available.

The vulnerability has a CVSS score of 4.6, indicating low severity, and it is not listed in CISA KEV. EPSS information is not available. The likely attack vector is local physical access; the flaw requires an attacker to be present on the target machine and does not require elevated privileges. Exploitation is straightforward for anyone who can run software locally on the victim’s computer, making it a trivial privilege escalation to an application‑level credential store.