An incorrect authorization check in Chrome’s CredentialProvider on Windows, discovered before version 156.0.8078.47, permits a local attacker who has already gained control of the renderer process to run arbitrary code outside the browser sandbox via a local program. The flaw stems from improper authorization and credential validation (CWE‑825, CWE‑863). By exploiting this weakness, the attacker can execute code with Chrome process privileges, potentially escalating privileges further.

Google Chrome on Windows machines with versions earlier than 156.0.8078.47 are affected. The vulnerability exists across all stable channel releases that precede that build, regardless of minor patch levels, and targets the credential provider component used on Windows.

The CVSS score of 8.8 marks this as a high‑severity vulnerability. The EPSS score is < 1 %, indicating a low probability of exploitation. The attack requires local access to a compromised renderer process; exploitation would allow code execution with Chrome process privileges, potentially enabling further attacks. This vulnerability is not currently listed in CISA KEV.