Loading vulnerability…
Local Privilege Escalation in Google Chrome CredentialProvider
CVE-2026-19139 is a race condition in the CredentialProvider component of Google Chrome on Windows before version 151.0.7922.109. A local attacker can exploit the vulnerability through a malicious file to achieve operating-system-level privilege escalation. Chromium classifies the vulnerability as High severity. The affected function and precise race mechanism are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local attacker to elevate privileges on an affected Windows system, crossing an operating-system privilege boundary. The exact resulting privilege level and scope of access are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by enforcing least privilege, preventing untrusted local file execution, restricting users from operating with administrative rights, and applying application control or similar execution restrictions on Windows systems. These measures are temporary risk reductions and do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade Google Chrome on Windows to version 151.0.7922.109 or later. Restart Chrome after updating and verify that the fixed version is deployed across affected systems.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.