CVE-2026-84329: Confused deputy in Google Chrome

This vulnerability involves a confused deputy issue in the CredentialProvider of Google Chrome on Windows platforms before version 152.0.7977.75. It allows a remote attacker, with control over the renderer process, to leak sensitive information by crafting a malicious HTML page. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. The issue is tracked as CWE-441 (Incorrect Control of a Resource Through its Lifetime).

An attacker who has compromised the renderer process can leak sensitive information from the browser environment. The confidentiality of data is impacted, but integrity and availability are not affected. The attack requires user interaction and has a high attack complexity, limiting exploitation likelihood.

Users and administrators should update Google Chrome to version 152.0.7977.75 or later, where this vulnerability is fixed. No additional mitigation steps are indicated or required beyond applying the official update.