CVE-2026-76037
Description
A flaw was found in Google Chrome. A local attacker could exploit a link following vulnerability within the CredentialProvider component. This vulnerability allows for the execution of arbitrary code outside the browser's security sandbox through a local program.
Statement
This vulnerability affects Chromium-based browsers and applications utilizing QtWebEngine in Red Hat Community Projects. A local attacker could exploit a link following flaw within the CredentialProvider component, leading to arbitrary code execution outside the browser's sandbox. Exploitation requires user interaction, such as clicking a malicious link.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
