Executive brief
Google Chrome's Core component contains an authorization flaw that allows a local attacker to execute arbitrary code outside the browser sandbox on Windows systems. This bypasses Chrome's primary security boundary, enabling a local program to gain elevated privileges and compromise the system. The vulnerability affects versions prior to 153.0.8010.47.
Technical details
An incorrect authorization vulnerability exists in the Core component of Google Chrome on Windows prior to version 153.0.8010.47. The vulnerability allows a local attacker with access to a local program to bypass Chrome's sandbox boundary and execute arbitrary code outside the sandbox with elevated privileges. This is a privilege escalation / sandbox escape vulnerability requiring local access but no user interaction or authentication. An attacker can exploit this via a malicious local program to compromise system integrity. The vulnerability was patched in Chrome 153.0.8010.47 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in Chrome 153.0.8010.47