CVE-2026-14124: Chrome Windows Privilege Escalation via CredentialProvider Flaw

Technical summary

CVE-2026-14124 stems from an inappropriate implementation in Chrome's CredentialProvider component (CWE-269: Improper Access Control). The flaw allows a local, unauthenticated attacker to achieve OS-level privilege escalation on Windows systems. The attack requires user interaction (UI component) but does not require the attacker to already possess elevated privileges. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Windows platforms. Although Chromium's internal severity rating is Low, the CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local access, high impact on confidentiality, integrity, and availability, and the relatively low barrier to exploitation.

Business impact

This vulnerability poses a significant risk to Windows-based organizations where Chrome is deployed. An attacker who gains initial low-privilege access to a Windows system can exploit this flaw to obtain system-level permissions, enabling subsequent lateral movement, data exfiltration, malware persistence, and full system compromise. Organizations relying on privilege boundaries and user account controls as part of their defense-in-depth strategy should prioritize remediation, as the flaw undermines those controls. The user-interaction requirement means phishing campaigns or social engineering could be used to trigger exploitation at scale.

Affected systems

Google Chrome on Microsoft Windows versions prior to 150.0.7871.47 are affected. The vulnerability does not impact Chrome on other operating systems (Linux, macOS, Android, iOS) or other Chromium-based browsers unless they incorporate the same vulnerable code path. Organizations should inventory Windows systems running Chrome and determine which versions are deployed.

Exploitability

The vulnerability is practical to exploit. It requires local system access and user interaction (opening or interacting with a malicious file), but no pre-existing elevated privileges. An attacker can craft a file that, when opened by a user, triggers the CredentialProvider flaw to escalate privileges. This makes it a credible post-compromise or user-targeting attack vector. The lack of KEV designation indicates it has not yet been observed in active exploitation campaigns, but that does not diminish its practical risk.

Remediation

Update Google Chrome on Windows to version 150.0.7871.47 or later. The patch addresses the implementation flaw in CredentialProvider. Organizations should verify patch deployment through browser update mechanisms or centralized management tools (e.g., Google Chrome Enterprise), and confirm that auto-update is enabled or patches are deployed within their change management process. Additionally, enforce user awareness training to reduce the likelihood of users opening or interacting with untrusted files.

Patch guidance

Verify that Google Chrome on Windows systems is updated to version 150.0.7871.47 or later. Chrome auto-update should deploy the patch automatically, but administrators can manually trigger updates via Settings > About Chrome. For managed environments, deploy through Google Chrome Enterprise policy controls or your organization's software deployment tools. Test the patch in a non-production environment first, then schedule a phased rollout to production systems. Confirm patch application by checking Chrome's version number in Settings > About Chrome and cross-reference against vendor advisories.

Detection guidance

Monitor for failed attempts to open suspicious files or scripts on Windows systems. Look for unusual CredentialProvider activity, privilege escalation attempts (e.g., UAC prompts triggered unexpectedly), or newly spawned processes running with elevated privileges following user interaction with files. Endpoint Detection and Response (EDR) tools should flag suspicious file interactions and privilege escalation events. Review Windows Security Event Log for privilege escalation events and token impersonation attempts. Network monitoring may detect file delivery mechanisms (email attachments, shares) preceding exploitation attempts.

Why prioritize this

This vulnerability merits high priority despite the lack of active exploitation (no KEV status). The combination of high CVSS score (7.8), low exploitation barrier (user interaction only, no special privileges), and full system compromise potential make it a credible attack vector. The prevalence of Chrome on Windows, the effectiveness of social engineering to trigger file interactions, and the direct path to privilege escalation justify urgent patching. Delay increases organizational risk if attackers develop or discover working exploits.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of OS-level privilege escalation, which grants an attacker complete control over the system and its data. The user-interaction requirement moderately lowers the score compared to a fully remote or privileged exploit, but the ease of weaponizing this via social engineering and the ubiquity of Chrome justify the HIGH severity designation.

Frequently asked questions