Google Chrome CVE-2026-13800

Exploitation requires local access to the Windows host and involves the Chrome Updater component processing an attacker-supplied malicious file, per the description; the CVSS vector also mandates user interaction (UI:R), so some victim/user action is needed to trigger the vulnerable update path. What limits exploitation: the attacker must already be able to run code or write files as a local (unprivileged) user on the machine (AV:L), the target must be Windows running Chrome before 150.0.7871.47, and the required user interaction gates fully automated abuse. It is not remotely exploitable and does not affect default remote-facing configurations - it is a post-access escalation condition tied specifically to the Windows Updater.

The signals are internally consistent and point to a genuine but not urgent local-privilege-escalation issue. CVSS 3.1 is 7.8 (High) with AV:L (local), AC:L (low complexity), PR:N (no prior privileges), UI:R (user interaction required), and full C:H/I:H/A:H impact - a classic local EoP profile, not a remotely wormable bug. EPSS corroborates lower real-world urgency at 0.13% (3rd percentile), and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. No POC is referenced. The AV:L means an attacker must already have a foothold on the host and the UI:R gate implies some victim action, both of which limit mass exploitation. Net: patch on the normal Chrome update cadence - this is a meaningful post-compromise escalation primitive (chainable after initial access) rather than a drop-everything internet-facing emergency.

An attacker who already has an unprivileged foothold on a Windows workstation plants a malicious file in a location the Chrome Updater trusts and induces the required user action, causing the elevated updater process to consume it and execute attacker-controlled logic at OS level. This turns a limited user session into SYSTEM-level control, a common escalation step after phishing or malware delivery. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means a working exploit would be straightforward once developed.