CVE-2026-76037: Google Chrome RCE Vulnerability

CVE-2026-76037 Overview

CVE-2026-76037 is a link following vulnerability [CWE-59] in the CredentialProvider component of Google Chrome on Windows. Versions of Chrome prior to 151.0.7922.169 are affected. A local attacker can leverage a malicious program to abuse symbolic or hard link resolution, allowing arbitrary code execution outside the Chrome sandbox. Chromium classified the security severity as High, and the CVSS 3.1 base score is 8.4. The flaw impacts confidentiality, integrity, and availability at the operating system level once exploited.

Critical Impact
Local attackers can escape the Chrome sandbox and execute arbitrary code with the privileges of the browser process on Windows endpoints running Chrome versions before 151.0.7922.169.

Affected Products

Google Chrome for Windows versions prior to 151.0.7922.169
Microsoft Windows systems running vulnerable Chrome builds
Chromium-based deployments incorporating the affected CredentialProvider code path

Discovery Timeline

2026-08-18 - CVE-2026-76037 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76037

Vulnerability Analysis

The vulnerability resides in Chrome's CredentialProvider component on Windows. CredentialProvider interfaces with the Windows logon and credential subsystem, requiring privileged file operations outside the browser sandbox. The component does not adequately validate whether file paths it operates on are symbolic links, junctions, or hard links controlled by a lower-privileged process.

A local attacker running a program on the same system can plant a filesystem link that redirects a trusted CredentialProvider operation to an attacker-chosen location. When Chrome performs the linked file operation, the action executes outside the sandbox boundary. The result is arbitrary code execution in the higher-privileged process context. See the Chromium Issue Tracker #517612295 for tracking details.

Root Cause

The root cause is improper link resolution [CWE-59] during privileged file handling in CredentialProvider. Chrome trusts a path that a local, unprivileged process can influence. The component fails to canonicalize the target or reject reparse points before performing sensitive operations. This mismatch between the assumed and actual filesystem target enables a sandbox escape.

Attack Vector

Exploitation requires local access. An attacker must execute code on the target system as a standard user or from a compromised low-integrity process such as a Chrome renderer. The attacker creates a filesystem link that points a CredentialProvider operation toward a sensitive location. When Chrome interacts with the linked path, the operation executes with the elevated privileges of the browser process outside the sandbox. No user interaction is required beyond running Chrome. Public proof-of-concept code has not been released, and CISA has not listed the flaw in the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-76037

Indicators of Compromise

Creation of symbolic links, junctions, or hard links inside directories used by Chrome's CredentialProvider component under %LOCALAPPDATA%\Google\Chrome\User Data
Unexpected child processes spawned by chrome.exe performing filesystem or credential operations
Chrome-initiated writes or reads targeting sensitive Windows locations outside standard user profile paths

Detection Strategies

Monitor for CreateSymbolicLink, NtCreateFile with reparse point flags, and mklink usage originating from non-administrative processes
Alert on Chrome processes accessing paths that resolve through reparse points to system or user credential stores
Correlate Chrome version telemetry with endpoint inventory to identify hosts running builds prior to 151.0.7922.169

Monitoring Recommendations

Enable Windows object access auditing on directories consumed by Chrome credential and profile services
Ingest Sysmon Event ID 1 (process creation) and Event ID 11 (file create) from endpoints running Chrome
Review EDR telemetry for post-exploitation behavior chained from chrome.exe, including code execution, persistence, or lateral movement attempts

How to Mitigate CVE-2026-76037

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 151.0.7922.169 or later
Restart Chrome after updating to ensure the patched CredentialProvider binary is loaded
Audit endpoints for the presence of vulnerable Chrome builds and prioritize patching multi-user or shared workstations

Patch Information

Google released the fix in the Stable Channel update announced in the Google Chrome Desktop Update. Administrators should deploy Chrome 151.0.7922.169 or newer through enterprise update mechanisms such as Google Update, Microsoft Intune, or Group Policy managed installers. Verify the installed version by checking chrome://settings/help on managed endpoints.

Workarounds

Restrict local user permissions to prevent untrusted programs from creating symbolic links or junctions, since creating symlinks on Windows requires the SeCreateSymbolicLinkPrivilege right
Limit interactive logon on shared workstations to reduce the pool of users capable of staging local exploitation
Enforce application allowlisting to block execution of untrusted binaries that could plant malicious filesystem links

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Force Chrome update via Google Update on managed hosts
"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler