Executive brief
A vulnerability in the Google Chrome update component on Windows could allow a local attacker to gain elevated system privileges. By tricking a user into opening a malicious file, an attacker could bypass standard security restrictions to perform administrative actions on the computer. This could lead to full control over the affected system and unauthorized access to sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the Google Chrome Updater component on Windows (CWE-416). The flaw is triggered when the updater improperly handles memory objects during the processing of a specially crafted malicious file. A local, unprivileged attacker can exploit this condition to execute arbitrary code with elevated system privileges. The vulnerability was addressed in Google Chrome version 150.0.7871.47. Exploitation requires the attacker to have local access and typically involves user interaction to process the malicious file.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched