CredentialProvider in Google Chrome on Windows can inadvertently trigger link following that allows a local attacker to execute arbitrary code outside the Chrome sandbox. This flaw enables escape from the controlled environment, potentially giving the attacker full control over the affected user’s system. The vulnerability is classified as CWE‑59 – path traversal or similar file system issue. The Chromium project rates the severity as High.

Google Chrome on Windows versions earlier than 151.0.7922.169 are impacted. Users who have not upgraded to that revision or later are exposed to the risk described above.

The flaw requires local execution; an attacker must have access to the Windows machine and be able to induce the Chrome process to follow the vulnerable link. No publicly disclosed exploits exist, and the EPSS score is not available. The high severity rating indicates a potentially high impact if exploited. The vulnerability is not listed in CISA’s KEV catalog. A valid Chrome update mitigates the issue completely.