Google Chrome: Memory corruption in CredentialProvider on Windows
Summary
Google Chrome on Windows prior to 156.0.8078.47 contains a memory corruption flaw in the CredentialProvider component. A remote attacker who can lure a user to a crafted HTML page may potentially execute arbitrary code outside the Chrome sandbox. The CVSS score is 9.6 (Critical), while the Chromium security severity is rated Medium.
Affected
- Google Chrome desktop on Windows prior to 156.0.8078.47
- Linux and other platforms: not described in the CVE; Ubuntu lists its chromium-browser package as not affected
Fixed in
- Google Chrome 156.0.8078.47 or later for Windows (vendor release of 20 Oct 2026)
- A later 156.x build was published on 27 Oct 2026; verify the exact build against the Chrome Releases blog
- Microsoft Edge: version 156.0.4314.42 or later (per HKCERT, to be verified)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed
- CISA KEV status: not listed according to a third-party tracker; check the CISA KEV catalog directly
- EPSS: Unknown
- Public proof of concept: none found
Our recommendation
- Verify that Chrome on all Windows endpoints is at 156.0.8078.47 or later, ideally the latest 156.x build
- Verify that Microsoft Edge is at or above the fixed build
- Inventory Google Credential Provider for Windows (GCPW) installations and update them, because the Chromium tracker refers to GCPW
- Re-check the Chromium tracker entry 502085234 and the NVD record, because the tracker title mentions a local privilege escalation in GCPW, which differs from the CVE text
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 502085234 issues.chromium.org
- NVD mirror (Vulners) vulners.com
- Ubuntu CVE tracker ubuntu.com
- HKCERT security bulletin (Microsoft Edge) www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:25.
Original description (NVD)
Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.