CVE-2026-84329 in Chrome
Summary
by MITRE • 09/02/2026
Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a confused deputy flaw within Google Chrome's CredentialProvider on Windows represents a significant breach in privilege separation, specifically affecting versions prior to 152.0.7977.75. This issue stems from an improper authorization check where the browser fails to correctly verify whether the requesting entity has sufficient privileges to access sensitive credential data. In this context, the CredentialProvider is responsible for managing and retrieving stored passwords and authentication tokens. The core technical flaw lies in the fact that while the renderer process operates under strict sandboxing restrictions designed to isolate it from system-level resources, a specific code path allowed an attacker who had already compromised the renderer process through other means to bypass these isolation boundaries when interacting with credential storage mechanisms.
From a technical perspective, this vulnerability exploits the principle of least privilege by allowing a lower-privileged component to act on behalf of a higher-privileged one without proper validation. When a malicious HTML page is loaded within the sandboxed renderer, it can craft specific API calls or script executions that target the CredentialProvider interface. Because the security check was insufficient, the browser erroneously granted access to sensitive authentication data, effectively treating the compromised renderer as if it were an authorized user with full credentials access. This misconfiguration allows for the exfiltration of usernames and passwords stored in Chrome's password manager, which are typically encrypted but accessible via these internal APIs when properly authenticated.
The operational impact of this vulnerability is severe due to its potential for remote exploitation through a crafted HTML page. An attacker does not need direct system access or physical presence; instead, they can lure a victim into visiting a malicious website that contains the exploit code. Once executed within the browser environment, the script leverages the confused deputy condition to extract sensitive login information from the user's profile. This leads directly to credential theft, which can result in unauthorized account access, identity theft, and further compromise of linked services if users reuse passwords across platforms. The severity is classified as low by Chromium standards primarily because it requires a pre-existing renderer compromise or successful drive-by download execution, but the data exposure risk remains high for end-users relying on browser-based password management.
This vulnerability aligns with CWE-274, which describes improper enforcement of proper authorization, and falls under MITRE ATT&CK technique T1556, specifically related to modifying authentication processes or credentials stored in browsers. To mitigate this risk, organizations should ensure that all instances of Google Chrome are updated to version 152.0.7977.75 or later, where the authorization checks within the CredentialProvider have been hardened. Additionally, users can reduce their exposure by disabling auto-fill for sensitive credentials, using dedicated password managers with separate security models, and employing browser extensions that enforce stricter content security policies to prevent unauthorized script execution from accessing internal APIs. Regular patching cycles are essential as this type of logic error in privilege escalation paths remains a persistent threat vector in complex software architectures like web browsers.