Executive brief
A vulnerability in Google Chrome on Windows could allow a local user to gain higher-level system permissions. By using a specially crafted file, an attacker who already has limited access to a computer could bypass security restrictions to take full control of the operating system. This could lead to unauthorized access to sensitive data or the installation of persistent malware.
Technical details
An inappropriate implementation vulnerability exists in the Mojo IPC (Inter-Process Communication) framework of Google Chrome on Windows. The flaw allows a local attacker to escalate their privileges to the OS level by leveraging a malicious file. The vulnerability is triggered through local interaction, where the attacker exploits the way Mojo handles certain system-level requests or file operations. This can result in a complete compromise of the host operating system. Google has addressed this issue in Chrome version 149.0.7827.115.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-05-26: disclosed: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in Stable Channel Update 149.0.7827.115
- 2026-06-11: advisory