EUVD-2026-50613
GHSA-m6p7-44xj-v2x9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local user access on macOS
-
DeliveryPlant malicious file for Updater
-
ExploitTrigger Chrome update/user interaction
-
ExecutionUpdater processes file with elevated rights
-
ImpactEscalate to OS-level privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a macOS system running a vulnerable Google Chrome build (prior to 151.0.7922.72) and the ability to place a malicious file that the privileged Chrome Updater component acts upon. Per the CVSS vector, user interaction is required (UI:R), which limits exploitation to scenarios where a legitimate action - such as an update trigger or browser launch - causes the Updater to process the attacker's file; the attack vector is local (AV:L), so remote exploitation is not possible. Limiting factors: the attacker must already have a local foothold, the target must be macOS specifically (Windows/Linux not affected), and the required user interaction means it cannot be fully autonomous. |
| Impact | The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High) and indicates a local attack vector, low complexity, no privileges required, but mandatory user interaction, with high confidentiality/integrity/availability impact from the resulting privilege escalation. Chromium's internal team labeled this Medium severity, which is common for local EoL/privilege issues that require an attacker to already have a foothold and user interaction, tempering the raw High CVSS. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or imminent widespread exploitation - this reads as a defense-in-depth hardening fix rather than an urgent internet-facing emergency. The realistic priority is moderate: high theoretical impact but gated behind local access and user interaction. Note the PR:N in the vector applies to the attacker's starting privilege (any local user), while the payoff is elevation to OS/root-level rights - verify the local-access assumption matches your threat model. |
| Exploit ScenarioDerived | A local attacker with a standard user account on a shared or multi-user Mac plants a malicious file in a location the privileged Chrome Updater will process, then relies on the required user interaction (e.g., triggering an update or launching the browser) to have the Updater act on that file with elevated rights, escalating to OS-level privileges. Given AV:L/AC:L, exploitation is low-complexity once local access exists, though it depends on the user-interaction step. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Local OS-level privilege escalation in Google Chrome's Updater component on macOS versions prior to 151.0.7922.72 allows a local attacker to elevate privileges by planting a malicious file that the Updater processes with higher rights. The flaw stems from improper privilege management (CWE-269) in the auto-update workflow, requires local access plus user interaction, and carries a CVSS 7.8 (High) rating; no public exploit has been identified at time of analysis. Rated Medium severity by Chromium's own security team despite the High CVSS.
RemediationAI
Vendor-released patch: update Google Chrome on macOS to 151.0.7922.72 or later, delivered through the Stable Channel update announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because the vulnerability is in the auto-update mechanism itself, confirm the update actually applied by checking chrome://settings/help and relaunching the browser, and in managed fleets push the fixed version via MDM rather than relying solely on background auto-update. As a compensating control until patched, restrict local/interactive access to macOS endpoints and avoid running as or granting admin rights to untrusted local users, since exploitation requires a local attacker to place a malicious file and induce user interaction; this reduces exposure but does not eliminate the underlying Updater flaw. Reference the tracking issue https://issues.chromium.org/issues/520494861 for vendor detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Chrome's Updater on macOS - the background service (historically Keystone/GoogleUpdater) responsible for fetching and installing browser updates, which typically runs with elevated privileges to write into system-level install locations. The root cause is classified as CWE-269 (Improper Privilege Management): the Updater's handling of a file allows a lower-privileged local user to influence an operation executed at a higher privilege level, resulting in OS-level escalation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected application, and the issue is macOS-specific per the advisory. Because the Updater operates as a privileged helper, weaknesses in how it validates or trusts on-disk files can be leveraged to cross a privilege boundary that the browser sandbox is not designed to protect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector and no starting privileges match a local user planting a file, with mandatory user interaction gating the privileged Updater action and full OS-level compromise impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's auto-update component for macOS contains a privilege escalation vulnerability (CVE-2026-17864) affecting versions prior to 151.0.7922.72, allowing local attackers to elevate system privileges through improper handling during the update workflow. Organizations with macOS deployments must patch immediately to prevent attackers with initial system access from escalating privileges and compromising system integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB