Improper privilege management in Google Chrome's CredentialProvider on Windows prior to 156.0.8078.47 allows a local attacker with physical access to execute arbitrary code outside the browser sandbox. The flaw is a privilege escalation vulnerability (CWE-269).

The vulnerability is relevant to Google Chrome for Windows prior to version 156.0.8078.47. Users running any unsupported or older Windows build with Chrome versions before the specified update are affected.

The CVSS score of 9.6 indicates a high severity, but the EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack vectors require physical local access to the machine, permitting a local attacker to bypass Chrome's sandbox and execute code. No widespread active attacks are known, yet the high CVSS score underscores that the flaw is easily exploitable if local access is achieved.