critical severity ยท published 2026-10-20
A local attacker can run their own code on the computer outside Chrome's sandbox through physical access to the computer, using an improper privilege management flaw in the CredentialProvider component of Chrome on Windows. Chromium rates it Medium.
Fixed in: 156.0.8078.47
CVE: CVE-2026-113283
Source: NVD
Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 460 and your operating system.