EUVD-2026-40706
GHSA-mrjj-7f34-vq7c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file exploitation (AV:L) with no prior privileges (PR:N) but required interaction (UI:R); the privileged updater yields full C/I/A compromise via SYSTEM-level privilege escalation.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
AnalysisAI
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), indicating negligible observed exploitation activity.
Technical ContextAI
The flaw is a CWE-416 use-after-free in the Google Chrome Updater on Windows - the background service (Google Update / the Chromium updater) responsible for keeping the browser current, which historically runs at high or SYSTEM integrity to write to protected Program Files locations and modify installed binaries. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker who controls heap contents to redirect execution or corrupt state. Because the affected process is the privileged updater rather than the sandboxed renderer, successful exploitation converts control of a freed object into code execution in a high-privilege context. The single affected build boundary reported is Chrome 150.0.7871.47 on the Windows platform; no CPE strings were supplied, but the EUVD affected-version range confirms all builds below 150.0.7871.47.
RemediationAI
Vendor-released patch: update Google Chrome for Windows to 150.0.7871.47 or later via the Stable channel; in most deployments Chrome's built-in auto-updater will apply this automatically, so the primary action is to confirm auto-update is enabled and force a restart of the browser (and the updater service) to complete installation, verifying the version under chrome://settings/help. In managed environments push the update through your software distribution or ADMX policy. Because the vulnerable code is the privileged Updater itself, the most reliable compensating control while patching is to ensure the update actually lands rather than disabling the updater - do not turn off auto-update, as that would leave the browser unpatched. As an interim measure, restrict local/interactive access to the host and limit which non-admin users can drop or execute files in updater-writable paths, since exploitation requires local presence and a malicious file; note this reduces but does not eliminate risk. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for the authoritative fixed version.
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today