{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76037", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-08-18T19:44:51.243Z", "datePublished": "2026-08-18T20:31:25.594Z", "dateUpdated": "2026-08-19T11:29:02.864Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "151.0.7922.169", "status": "affected", "lessThan": "151.0.7922.169", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Link following", "cweId": "CWE-59"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-08-18T20:31:25.594Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html"}, {"url": "https://issues.chromium.org/issues/517612295"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T11:28:06.394565Z", "id": "CVE-2026-76037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T11:29:02.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-76037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T11:28:06.394565Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T11:28:44.907Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "151.0.7922.169", "lessThan": "151.0.7922.169", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html"}, {"url": "https://issues.chromium.org/issues/517612295"}], "descriptions": [{"lang": "en", "value": "Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-59", "description": "Link following"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-08-18T20:31:25.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76037", "state": "PUBLISHED", "dateUpdated": "2026-08-19T11:29:02.864Z", "dateReserved": "2026-08-18T19:44:51.243Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2026-08-18T20:31:25.594Z", "assignerShortName": "Chrome"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "151.0.7922.169", "status": "affected", "version": "151.0.7922.169", "versionType": "custom"}]}], "source": "chrome-cve-admin@google.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}], "id": "CVE-2026-76037", "lastModified": "2026-08-19T12:52:26.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76037", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T11:28:06.394565Z", "version": "2.0.3"}}]}, "published": "2026-08-18T21:18:27.727", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/517612295"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "chrome-cve-admin@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "chromium-browser: Google Chrome: Arbitrary Code Execution via Link Following", "id": "2518261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518261"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in Google Chrome. A local attacker could exploit a link following vulnerability within the CredentialProvider component. This vulnerability allows for the execution of arbitrary code outside the browser's security sandbox through a local program."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-76037", "public_date": "2026-08-18T20:31:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76037\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76037\nhttps://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html\nhttps://issues.chromium.org/issues/517612295"], "statement": "This vulnerability affects Chromium-based browsers and applications utilizing QtWebEngine in Red Hat Community Projects. A local attacker could exploit a link following flaw within the CredentialProvider component, leading to arbitrary code execution outside the browser's sandbox. Exploitation requires user interaction, such as clicking a malicious link.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "151.0.7922.169"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "created": "2026-08-18T21:30:04.551590+00:00", "title": "Chrome CredentialProvider Local Code Execution via Link Following", "updated": "2026-08-18T21:45:16.890338+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}