CVE-2026-84329 Overview
CVE-2026-84329 is a confused deputy vulnerability in the CredentialProvider component of Google Chrome on Windows. Versions prior to 152.0.7977.75 are affected. A remote attacker who has already compromised the renderer process can exploit the flaw to leak sensitive information through a crafted HTML page. The Chromium project classifies the underlying security severity as Low, while the NVD scoring places it in the medium range due to the confidentiality impact. The vulnerability is tracked under CWE-441: Unintended Proxy or Intermediary.
Critical Impact
An attacker with an already-compromised renderer process can leak sensitive information handled by the Windows credential provider integration in Chrome.
Affected Products
- Google Chrome for Windows versions prior to 152.0.7977.75
- Chromium-based browsers on Windows that share the vulnerable CredentialProvider code path
- Enterprise Windows endpoints running unpatched Chrome Stable channel builds
Discovery Timeline
- 2026-09-02 - CVE-2026-84329 published to NVD
- 2026-09-02 - Last updated in NVD database
- 2026-09 - Google Chrome Stable channel update released addressing the issue (see Google Chrome Release Update)
Technical Details for CVE-2026-84329
Vulnerability Analysis
The vulnerability is a confused deputy weakness in Chrome's CredentialProvider on Windows. A confused deputy occurs when a privileged component performs an action on behalf of a less-privileged caller without correctly checking the caller's authority or intended target. In this case, the browser process acts as the deputy for the renderer and can be tricked into exposing information it holds on behalf of the user.
Exploitation requires two conditions. First, the attacker must already have compromised the renderer process, typically by chaining a prior memory-safety bug. Second, the victim must interact with a crafted HTML page delivered by the attacker. When both conditions are met, the renderer can steer the CredentialProvider path to return sensitive data outside the intended trust boundary.
The impact is limited to confidentiality. There is no direct integrity or availability impact, and no sandbox escape is claimed. Additional context is available in Chromium Issue #498850269.
Root Cause
The root cause is insufficient validation of the caller's authority when the CredentialProvider integration services requests originating from renderer IPC. The privileged code path does not consistently confirm that the request corresponds to the origin or scope the user intends, satisfying the pattern described in [CWE-441].
Attack Vector
The attack vector is network-based but requires user interaction and a prior renderer compromise, which raises attack complexity. A typical chain would deliver an HTML page that triggers a renderer exploit, then uses IPC to the browser process to elicit sensitive data through the confused CredentialProvider path.
No verified proof-of-concept code is publicly available for this CVE. Refer to the Chromium issue tracker entry once access restrictions are lifted for full technical details.
Detection Methods for CVE-2026-84329
Indicators of Compromise
- Chrome browser processes on Windows running versions earlier than 152.0.7977.75 in production environments.
- Renderer process crashes or anomalous child-process spawning correlated with visits to untrusted HTML pages.
- Unexpected IPC activity between renderer processes and the browser process targeting credential-related interfaces.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any host below 152.0.7977.75.
- Correlate web proxy or DNS telemetry with endpoint browser telemetry to identify sessions where a renderer exploit chain may have executed prior to credential access.
- Monitor for outbound transfers of data patterns consistent with credentials or session material following browser activity on untrusted origins.
Monitoring Recommendations
- Enable Chrome enterprise reporting to centralize version and extension telemetry for compliance tracking.
- Alert on Chrome installations that fall behind the current Stable channel version by more than one release.
- Track visits to newly registered or low-reputation domains from hosts that also show renderer instability events.
How to Mitigate CVE-2026-84329
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to 152.0.7977.75 or later.
- Force-restart Chrome after deployment to ensure the patched binaries are loaded into memory.
- Audit enterprise policy to confirm automatic updates are enabled and not blocked by network controls.
Patch Information
Google addressed CVE-2026-84329 in the Chrome Stable channel update announced in the Google Chrome Release Update. Windows users should upgrade to Chrome 152.0.7977.75 or later. Downstream Chromium-based browsers should apply the corresponding vendor release once available.
Workarounds
- Restrict browsing to trusted sites for privileged accounts until patching is complete.
- Deploy site isolation and strict process-per-site policies to reduce the value of a compromised renderer.
- Reduce exposure of high-value credentials in browser sessions by using dedicated administrative workstations.
# Verify installed Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Force Chrome update check on a managed endpoint
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
