EUVD-2026-40781
GHSA-c3m3-f85p-m2r3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access on Windows host
-
DeliveryPlant malicious file for installer
-
ExploitTrigger Chrome installer run (UI:R)
-
ExecutionExploit use-after-free in installer
-
PersistHijack execution in elevated context
-
ImpactEscalate to OS-level privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a Windows host running Chrome prior to 150.0.7871.47, the ability to place a malicious file that the Chrome Installer processes, and user interaction (UI:R) to trigger the installation/update flow that reaches the vulnerable use-after-free path. Limiting factors: the attack vector is local (AV:L) - no remote/network exploitation is possible - exploitation is Windows-installer-specific, and it depends on the victim or an elevated process actually running the installer, which is why CISA SSVC marks it non-automatable. These constraints make it a targeted local privilege-escalation vector rather than a broadly exploitable remote flaw. |
| Impact | Signals are consistent and point to a genuine-but-not-urgent local privilege-escalation issue rather than a mass-exploitation threat. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) drives the 7.8 High score through total confidentiality/integrity/availability impact, but the local attack vector and required user interaction cap real-world exposure. EPSS is very low at 0.11% (2nd percentile) and CISA SSVC reports Exploitation: none and Automatable: no, aligning with 'no public exploit identified at time of analysis.' Notably, Google's own Chromium severity rating is Low, which contrasts with the 7.8 CVSS High - this divergence is expected for local EoP-via-installer bugs and suggests the CVSS score overstates practical priority. Bottom line: patch on normal cadence; this is not a drop-everything emergency for most environments. |
| Exploit ScenarioDerived | A local attacker with a limited account on a shared Windows machine plants a specially crafted malicious file where the Chrome installer will process it, then induces the victim (or an automatic/elevated install flow) to run the installer. The use-after-free is triggered during installation and the attacker's controlled memory redirects execution, elevating from the low-privileged user to the installer's elevated (SYSTEM-level) context. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.
RemediationAI
Vendor-released patch: Google Chrome 150.0.7871.47 - upgrade to this version or later on Windows, then fully restart the browser so the update is applied (Chrome auto-updates, but a relaunch is required to complete installation). Confirm rollout via the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation depends on a local attacker placing a malicious file that the installer processes, interim compensating controls include restricting local/interactive access on multi-user Windows hosts, enforcing least privilege so untrusted users cannot stage files into installer-read locations, and monitoring for unexpected file drops or installer executions; these controls reduce opportunity but do not remove the underlying use-after-free, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the Chrome Installer on Windows and is classified as CWE-416 (Use After Free), a memory-corruption class where a pointer to freed heap memory is reused, letting an attacker control the contents of the reallocated region to hijack execution flow. Because the vulnerable code path runs within the installer - a process that typically executes with elevated/SYSTEM privileges to write into Program Files and register components - successfully controlling the freed object yields code execution at that higher privilege level. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to the fix), and the issue is platform-specific to the Windows installer rather than the browser's rendering or sandbox layers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local installer flaw needing no prior privileges but victim-triggered install (UI:R); successful UAF yields code execution in the elevated installer context, so C/I/A all High.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's Windows installer (versions before 150.0.7871.47) is vulnerable to privilege escalation, allowing local attackers to execute code with system privileges; no public exploit has been identified at this time. This affects organizations using Chrome on Windows and could compromise individual machines and bypass security controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB