CVE-2026-76037: Link following in Google Chrome
CVE-2026-76037 is a high-severity vulnerability in Google Chrome on Windows prior to version 151.0.7922.169. It involves link following in the CredentialProvider component, which could allow a local attacker to execute arbitrary code outside the browser sandbox via a local program. This vulnerability affects local privilege boundaries and could lead to code execution if exploited.
AI Analysis
Technical Summary
This vulnerability in Google Chrome's CredentialProvider on Windows versions before 151.0.7922.169 allows a local attacker to potentially execute arbitrary code outside the sandbox by exploiting link following behavior. The issue is classified as high severity by Chromium security. No CVSS score is provided. The vulnerability was publicly disclosed on August 18, 2026. The vendor advisory URL points to a Chrome stable channel update blog post, but no explicit patch or remediation details are included in the provided data.
Potential Impact
A local attacker could leverage this vulnerability to execute arbitrary code outside the sandbox, potentially compromising the security boundaries of the Chrome browser on Windows. This could lead to unauthorized code execution with local privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html for current remediation guidance. Since the affected version is prior to 151.0.7922.169, updating to version 151.0.7922.169 or later is likely recommended once confirmed by the vendor.
CVE-2026-76037: Link following in Google Chrome
Description
CVE-2026-76037 is a high-severity vulnerability in Google Chrome on Windows prior to version 151.0.7922.169. It involves link following in the CredentialProvider component, which could allow a local attacker to execute arbitrary code outside the browser sandbox via a local program. This vulnerability affects local privilege boundaries and could lead to code execution if exploited.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Google Chrome's CredentialProvider on Windows versions before 151.0.7922.169 allows a local attacker to potentially execute arbitrary code outside the sandbox by exploiting link following behavior. The issue is classified as high severity by Chromium security. No CVSS score is provided. The vulnerability was publicly disclosed on August 18, 2026. The vendor advisory URL points to a Chrome stable channel update blog post, but no explicit patch or remediation details are included in the provided data.
Potential Impact
A local attacker could leverage this vulnerability to execute arbitrary code outside the sandbox, potentially compromising the security boundaries of the Chrome browser on Windows. This could lead to unauthorized code execution with local privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html for current remediation guidance. Since the affected version is prior to 151.0.7922.169, updating to version 151.0.7922.169 or later is likely recommended once confirmed by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-08-18T19:44:51.243Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html","vendor":"Google"}]
Threat ID: 6a84c574c6e8be0332bb23f2
Added to database: 08/18/2026, 20:49:56 UTC
Last enriched: 08/18/2026, 21:05:37 UTC
Last updated: 08/18/2026, 22:25:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.