EUVD-2026-50842
GHSA-qh6m-vhx2-qh42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to macOS host
-
DeliverySend malicious traffic to Chrome updater
-
ExploitTrigger use-after-free in updater
-
ExecutionExecute code as privileged updater
-
ImpactEscalate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local presence on a macOS system running Google Chrome older than 151.0.7922.72, and specifically targets the Chrome Updater component, triggered by malicious network traffic that the local attacker delivers to that updater. Limiting factors: the CVSS vector is local (AV:L), so this cannot be triggered by a remote unauthenticated attacker over the internet against a default install; the target must be the macOS build (the platform is called out explicitly); and the affected privileged updater service must be present and reachable by the attacker's crafted traffic. No user interaction is required (UI:N) and no prior privileges are strictly required per the vector (PR:N), but the need for local access is the dominant constraint that keeps real-world risk below what the 8.4 base score alone suggests. |
| Impact | The signals are largely consistent toward a real but not urgent priority. CVSS 8.4 reflects high confidentiality, integrity, and availability impact (C:H/I:H/A:H) with low attack complexity, but the vector is explicitly local (AV:L), which caps real-world reach - this is a local privilege-escalation issue, not a remotely reachable RCE. EPSS is low (0.18%), the SSVC decision records Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit identified, all of which argue against imminent mass exploitation, while SSVC Technical Impact: total confirms that successful exploitation yields full control of the targeted component. One conflict deserves attention: the CVSS vector is AV:L (local) yet the description says exploitation occurs 'via malicious network traffic' - these are reconcilable if a local attacker feeds crafted traffic to the local updater, but defenders should verify the exact reachability with the Chrome advisory rather than assume network-facing exposure. |
| Exploit ScenarioDerived | A local attacker who already has a foothold on a macOS machine - for example an unprivileged user account or a low-privilege process from a prior compromise - feeds crafted/malicious traffic to Chrome's privileged updater to trigger the use-after-free, corrupting memory and elevating to the updater's privilege level. Given the AV:L/AC:L profile the technical barrier is low once local access exists, but no public proof-of-concept has been identified, so this remains a plausible rather than demonstrated chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 30, 2026
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Earlier versions of this analysis (1)
Privilege escalation in the Updater component of Google Chrome on macOS versions prior to 151.0.7922.72 stems from a use-after-free memory corruption flaw that an adjacent-network attacker can trigger via malicious network traffic. Google rates the underlying Chromium bug High severity and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Successful exploitation could let an attacker corrupt memory in the updater process to gain elevated privileges on the host.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS, per Google's stable-channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome normally auto-updates, so ensure the browser is fully relaunched to complete installation and confirm the running version under chrome://settings/help; in managed fleets, push the updated build through your MDM or software-distribution tooling and verify the updater service itself is on the current release. Because the flaw is in the updater rather than page-rendering, disabling browser features does not mitigate it - the compensating control until patching is to restrict local access to the affected macOS hosts and monitor for anomalous updater process behavior, accepting that blocking or crippling the auto-updater would itself leave systems unpatched and is not advised.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Google Chrome's auto-update mechanism (the GoogleUpdater/Keystone service that keeps Chrome current on macOS), which typically runs with elevated privileges to write into protected application directories. CWE-416 (use-after-free) means the code continues to reference a heap object after it has been freed; an attacker who influences the timing or content of data the updater processes - here characterized as malicious network traffic reaching the updater - can cause the dangling pointer to be reused, corrupting memory and enabling controlled behavior in the privileged process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as the Google Chrome application; the exposure is specific to the macOS build of the updater rather than the browser renderer sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local attacker feeds crafted traffic to the privileged updater (AV:L, PR:N, UI:N); use-after-free yields full control of that component, so C/I/A all High with unchanged scope.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via malicious network traffic. (Chromium security severity: High)
Executive ViewAI
Google Chrome's Updater component on macOS (versions before 151.0.7922.72) contains a use-after-free vulnerability (CVSS 8.4) enabling privilege escalation and code execution in the privileged updater process. While no public exploit has been identified and exploitation likelihood is minimal (0.2% EPSS), this privilege escalation in a system component warrants timely patching across macOS Chrome deployments to maintain endpoint security posture.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB