CVE-2026-14124: Chrome CredentialProvider Privilege Escalation

CVE-2026-14124 Overview

CVE-2026-14124 is a privilege escalation vulnerability in the CredentialProvider component of Google Chrome on Windows. Versions prior to 150.0.7871.47 contain an inappropriate implementation that allows a local attacker to perform operating system level privilege escalation using a malicious file. The weakness is categorized under [CWE-269] Improper Privilege Management. Google's Chromium team rated the security severity as Low, but the CVSS 3.1 base score is 7.8 due to the high confidentiality, integrity, and availability impact on the underlying host.

Critical Impact
A local attacker who convinces a user to interact with a malicious file can escalate privileges on Windows through the Chrome CredentialProvider, gaining elevated access to the operating system.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Chromium-based browsers that embed the affected CredentialProvider implementation
Windows endpoints where Chrome's credential provider integration is registered with the OS

Discovery Timeline

2026-06-30 - CVE-2026-14124 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14124

Vulnerability Analysis

The vulnerability resides in Chrome's CredentialProvider, a component that integrates the browser with the Windows credential provider framework used at logon and for OS-level authentication flows. An inappropriate implementation in this component allows a local attacker to leverage a malicious file to trigger privileged behavior. The attacker requires local access and user interaction, but no prior privileges on the target system. Successful exploitation yields high impact across confidentiality, integrity, and availability because the resulting privilege escalation elevates code execution to an OS-level context. The flaw is tracked under [CWE-269] Improper Privilege Management, indicating that the affected code path does not correctly enforce privilege boundaries when handling attacker-controlled input.

Root Cause

The root cause is improper privilege management inside Chrome's Windows credential provider integration. The component processes a file supplied by the local user without adequately constraining the privileges granted to the resulting operation, permitting an unprivileged actor to influence execution that runs with higher OS rights.

Attack Vector

Exploitation requires local access to the Windows host and user interaction, such as opening or executing an attacker-supplied file. Once the malicious file is processed by the vulnerable CredentialProvider code path, the attacker gains elevated privileges on the operating system. Because no authentication is required and attack complexity is low, standard user accounts and guest sessions on shared endpoints are viable staging points. Technical specifics of the exploitation primitive are tracked in the Chromium Issue Tracker Entry and the Google Chrome Stable Update release notes.

Detection Methods for CVE-2026-14124

Indicators of Compromise

Unexpected child processes spawned by chrome.exe running under SYSTEM or elevated integrity levels
Registration or modification of credential provider CLSIDs under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers
Presence of suspicious files in Chrome user data directories immediately preceding privilege elevation events
Chrome installations reporting a version older than 150.0.7871.47 on Windows endpoints

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.47 on Windows
Monitor Windows Security event ID 4672 (special privileges assigned) correlated with Chrome process ancestry
Alert on writes to credential provider registry keys from non-installer processes
Baseline legitimate Chrome update behavior to identify anomalous privilege transitions from browser processes

Monitoring Recommendations

Enable process creation auditing (event ID 4688) with command line logging on Windows endpoints
Track file creation events in user-writable directories that are subsequently referenced by Chrome credential provider code paths
Forward endpoint telemetry to a centralized SIEM to correlate local file drops with subsequent privilege escalations
Review Chrome enterprise reporting logs for update failures that leave endpoints on vulnerable builds

How to Mitigate CVE-2026-14124

Immediate Actions Required

Update Google Chrome on Windows to version 150.0.7871.47 or later on all managed endpoints
Confirm that Chrome auto-update services (GoogleUpdate.exe) are running and reachable from the network
Audit endpoints for out-of-date Chrome builds and prioritize systems where users have local logon rights
Restrict execution of untrusted files delivered through email, removable media, or downloads on Windows hosts

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Upgrading to Chrome 150.0.7871.47 or later on Windows remediates the inappropriate implementation in CredentialProvider. Additional engineering context is available in the Chromium Issue Tracker Entry.

Workarounds

Enforce application control policies (Windows Defender Application Control or AppLocker) to block execution of unsigned files from user-writable paths
Remove local administrator rights from standard users to reduce the value of a successful escalation chain
Deploy Chrome via enterprise management (Chrome Browser Cloud Management or group policy) to enforce automatic updates
Restrict interactive logon on shared or kiosk systems until the patched Chrome build is confirmed installed

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check through Google Update
& "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler