EUVD-2026-40706
GHSA-mrjj-7f34-vq7c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file exploitation (AV:L) with no prior privileges (PR:N) but required interaction (UI:R); the privileged updater yields full C/I/A compromise via SYSTEM-level privilege escalation.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
AnalysisAI
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already have local access to a Windows host running a vulnerable Chrome build (prior to 150.0.7871.47) and to introduce a malicious file that the privileged Google Chrome Updater processes, which triggers the use-after-free (UI:R - some user or system interaction to act on the malicious file is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a real-but-not-urgent local privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already has an unprivileged foothold on a Windows machine (e.g., via a phished standard-user account) plants a specially crafted malicious file that the elevated Chrome Updater processes, triggering the use-after-free and executing attacker-controlled code at SYSTEM to escalate from standard user to full host control. The local attack vector and low complexity make this practical once local access exists, but user interaction is required and no public proof-of-concept exploit has been identified. |
| Remediation | Vendor-released patch: update Google Chrome for Windows to 150.0.7871.47 or later via the Stable channel; in most deployments Chrome's built-in auto-updater will apply this automatically, so the primary action is to confirm auto-update is enabled and force a restart of the browser (and the updater service) to complete installation, verifying the version under chrome://settings/help. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit your organization's Chrome deployment to identify machines running versions prior to 150.0.7871.47 and validate your update mechanisms are functioning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today