Google Chrome CVE-2026-11115

Local code execution on a Windows host running a vulnerable Chrome version (below 149.0.7827.53) is required, plus the ability to stage a malicious file consumed by the Chrome Updater component, plus user interaction (UI:R in CVSS) such as triggering an update event or restarting Chrome to invoke the updater. Exploitation is limited to the Windows platform - macOS and Linux Chrome are not affected - and requires the attacker to already hold a low-privileged local account (PR:L), so this is a post-compromise privilege-escalation primitive rather than an initial-access vector. Not exploitable remotely over the network and not exploitable against fully patched endpoints with the auto-updater already cycled to 149.0.7827.53 or later.

The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) describes a local attack requiring low privileges and user interaction, yielding high impact across confidentiality, integrity, and availability - consistent with a privilege escalation primitive rather than remote compromise. EPSS at 0.01% (1st percentile) and absence of CISA KEV listing indicate no observed in-the-wild exploitation, and no public exploit identified at time of analysis further reduces immediate risk. However, this class of bug is highly valuable for post-compromise escalation in targeted attacks and for chaining with browser sandbox escapes or initial-access malware, so it warrants timely patching on Windows endpoints despite the low EPSS score. Chromium-rated Medium severity aligns with this assessment of moderate but real risk; the discrepancy between CVSS 7.3 and EPSS 0.01% is typical for local-only Chrome bugs where attackers already need a foothold.

A local attacker with standard user access on a Windows endpoint places a malicious file in a location processed by the Chrome Updater, then triggers the updater to consume it (for example by invoking an update check or restarting Chrome). The use-after-free in the Updater corrupts memory in the privileged updater process, granting the attacker OS-level code execution to escalate from user to SYSTEM. No public exploit identified at time of analysis, but the bug class is well-understood and attractive for post-exploitation tooling.