Description
Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Published: 2026-08-18
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CredentialProvider in Google Chrome on Windows can inadvertently trigger link following that allows a local attacker to execute arbitrary code outside the Chrome sandbox. This flaw enables escape from the controlled environment, potentially giving the attacker full control over the affected user’s system. The vulnerability is classified as CWE-59 - path traversal or similar file system issue. The Chromium project rates the severity as High.

Affected Systems

Google Chrome on Windows versions earlier than 151.0.7922.169 are impacted. Users who have not upgraded to that revision or later are exposed to the risk described above.

Risk and Exploitability

The flaw requires local execution; an attacker must have access to the Windows machine and be able to induce the Chrome process to follow the vulnerable link. No publicly disclosed exploits exist, and the EPSS score is < 1%. The high severity rating, as reflected by the CVSS score of 8.4, indicates a potentially high impact if exploited. The vulnerability is not listed in CISA’s KEV catalog. A valid Chrome update mitigates the issue completely.

Generated by OpenCVE AI on August 21, 2026 at 16:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.169 or newer using the official update channel.
  • If immediate upgrade is not possible, limit the execution of local programs by applying Windows security policies that restrict Chrome’s ability to invoke local executables.
  • Configure Windows Defender Exploit Guard or similar tools to block execution of untrusted local programs triggered by Chrome.

Generated by OpenCVE AI on August 21, 2026 at 16:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4749-1 chromium security update
Debian DSA Debian DSA DSA-6455-1 chromium security update
History

Thu, 20 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Wed, 19 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome CredentialProvider Local Code Execution via Link Following chromium-browser: Google Chrome: Arbitrary Code Execution via Link Following
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Tue, 18 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Chrome CredentialProvider Local Code Execution via Link Following

Tue, 18 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Weaknesses CWE-59
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-20T03:55:39.183Z

Reserved: 2026-08-18T19:44:51.243Z

Link: CVE-2026-76037

cve-icon Vulnrichment

Updated: 2026-08-19T11:28:44.907Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:27.727

Modified: 2026-08-20T19:26:55.573

Link: CVE-2026-76037

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T20:31:25Z

Links: CVE-2026-76037 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T17:00:04Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')