Executive brief
A vulnerability in the Google Chrome installer for Windows could allow a local user to gain elevated system privileges. By using a specially crafted file during the installation or update process, an attacker who already has limited access to a computer could take full control of the operating system. This could lead to unauthorized access to sensitive data, the installation of malicious software, or the disruption of system operations.
Technical details
An inappropriate implementation in the Google Chrome Installer for Windows prior to version 149.0.7827.53 allows for local privilege escalation. The vulnerability is triggered when the installer processes a malicious file, potentially leading to an arbitrary file write or execution with SYSTEM-level privileges. An attacker must already have local access to the target machine to exploit this flaw. Successful exploitation allows a low-privileged user to escalate their permissions to the level of the operating system's installer service. Google has addressed this issue in Chrome version 149.0.7827.53/.54 for Windows.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11103 published.