Executive brief
A vulnerability in the Google Chrome update component on Windows could allow a local attacker to gain elevated system privileges. By using a specially crafted file, an attacker who already has limited access to a computer could take full control of the operating system. This could lead to unauthorized access to sensitive data, the ability to bypass security controls, or the installation of persistent malicious software.
Technical details
A privilege escalation vulnerability exists in the Google Chrome Updater for Windows due to an inappropriate implementation when handling files. A local, authenticated attacker can exploit this by placing a malicious file in a specific location or manipulating the update process to execute code with elevated system-level permissions. The vulnerability is classified by Chromium as High severity. The issue is resolved in Google Chrome version 150.0.7871.47 and later. Details regarding the specific mechanism of the 'inappropriate implementation' are currently restricted to prevent further exploitation.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-04-06: disclosed: Reported to Google
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47
- 2026-06-30: advisory