Executive brief
A vulnerability in the Google Chrome update component for macOS could allow a local user to gain elevated system privileges. By using a specially crafted file, an attacker who already has basic access to a computer could bypass security restrictions to perform administrative actions. This could lead to full control over the affected workstation, potentially compromising sensitive data or system integrity.
Technical details
An inappropriate implementation vulnerability exists in the Updater component of Google Chrome for macOS. The flaw allows a local, authenticated attacker to escalate their privileges to the OS level by leveraging a malicious file during the update process. While the specific root cause (such as a symlink race or insecure file permissions) is not detailed in the advisory, the impact is a full local privilege escalation (LPE). The issue is resolved in Google Chrome version 151.0.7922.72 for Mac.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date