Executive brief
A vulnerability in the Enterprise component of Google Chrome for macOS could allow a person with physical access to a device to gain elevated privileges. This issue stems from insufficient enforcement of security policies within the browser's enterprise management features. While the risk is limited by the requirement for physical access, it could potentially be used to bypass administrative restrictions on a shared or managed workstation.
Technical details
A vulnerability classified as insufficient policy enforcement exists in the Enterprise component of Google Chrome for macOS. The flaw allows a local attacker to achieve privilege escalation, provided they have physical access to the target machine. The root cause is a failure to strictly enforce enterprise-level security policies, which can be bypassed under specific physical interaction scenarios. This issue affects Google Chrome versions prior to 151.0.7922.72 on the Mac platform. Users are advised to update to version 151.0.7922.72 or later to mitigate this risk.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable channel update 151.0.7922.72 for Mac
- 2026-07-30: disclosed