CVE-2026-106340 in Chrome
Summary
by MITRE • 10/07/2026
Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization within the CredentialProvider component of Google Chrome for Windows represents a significant flaw in how authentication credentials are managed during system login sequences. Prior to version 155.0.8059.39, the implementation failed to enforce strict access controls when interacting with sensitive credential data stored or processed by the operating system's logon infrastructure. This architectural oversight allows any process running under a local user context on an affected Windows machine to query and extract authentication tokens or cached credentials that should remain isolated from unauthorized processes. The severity is classified as low within Chromium’s internal security framework, primarily because the attack vector requires physical access to the target device rather than remote network exploitation, yet it remains critical for environments where endpoint integrity is paramount.
From a technical perspective, this flaw exploits the interaction between Chrome and Windows Credential Provider APIs. When a user logs into a Windows system, various providers contribute credentials such as passwords, PINs, or biometric data to authenticate the session. The vulnerability arises because Chrome’s implementation did not adequately verify that the requesting process possessed the necessary privileges to access specific credential fields. Consequently, an attacker with local administrative rights or even standard user-level execution capabilities could invoke these APIs to retrieve sensitive authentication material. This bypasses expected isolation boundaries designed to prevent cross-process leakage of high-value secrets during the logon phase.
The operational impact of this vulnerability is centered on information disclosure and potential privilege escalation pathways for attackers who have already gained physical access to a workstation or server. By obtaining cached credentials, an attacker could potentially replay authentication tokens to gain unauthorized access to network resources, cloud services, or other systems where those same credentials are reused. This undermines the principle of least privilege and compromises the confidentiality assurance provided by modern operating system security models. While the immediate risk is limited to local attacks due to the physical access requirement, the downstream effects can be severe if credential reuse practices are prevalent within an organization’s infrastructure.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these authorization checks have been properly implemented and enforced. Organizations should ensure that endpoint management systems automatically deploy browser updates to minimize the window of exposure. Additionally, implementing strict physical access controls remains essential since this vulnerability cannot be exploited remotely. Security teams should also review credential storage policies to reduce reliance on cached credentials for critical services, thereby limiting the value of any data potentially exfiltrated through this vector.
This issue aligns with CWE-284 Improper Access Control and falls under ATT&CK technique T1078 Valid Accounts, specifically within the context of local authentication bypass or credential harvesting via physical access. Addressing such vulnerabilities requires a defense-in-depth approach that combines timely patch management with robust endpoint security policies to protect against both remote and physically proximate threats.