CVE-2026-84329: Confused deputy in Google Chrome

This vulnerability is a confused deputy flaw in the CredentialProvider component of Google Chrome on Windows platforms before version 152.0.7977.75. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page to leak sensitive information. The CVSS score is 5.3 (medium), reflecting a network attack vector with high complexity and user interaction required, resulting in confidentiality impact only. The vendor advisory link points to a stable channel update announcement but does not explicitly confirm patch availability or remediation details.

The vulnerability allows an attacker with control over the renderer process to leak sensitive information, impacting confidentiality. There is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation, users should update to version 152.0.7977.75 or later if available, as the affected versions are prior to this release.