What is the CVSS score of CVE-2026-17993?

CVE-2026-17993 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17993?

Google Chrome Updater on Windows (versions prior to 151.0.7922.72) contains a local privilege escalation vulnerability that allows low-privileged users to gain system-level access through a race…. A patch is available.

How to fix or mitigate CVE-2026-17993?

Within 24 hours, identify Windows systems running Chrome versions prior to 151.0.7922.72 using endpoint management tools or Chrome sync data. Within 7 days, deploy Chrome version 151.0.7922.72 or later via Group Policy, mobile device management, or Chrome Enterprise policies to ensure automatic updates are enabled and targeted. Within 30 days, verify deployment completion across all Windows endpoints and confirm all systems have reached the patched version through compliance reporting.

Google Chrome CVE-2026-17993

EUVD-2026-50919 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-8854-j33c-jpcf

Privilege Escalation Google Race Condition Microsoft Red Hat Suse

High

Disputed · 7.0 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local attacker must already run code as a user (PR:L) and win a timing race during an update (AC:H, UI:R); success yields full elevation, so C/I/A all High.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.9 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:34 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.0

DescriptionCVE.org

Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

AnalysisAI

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's auto-update mechanism on Windows, which typically runs with elevated (SYSTEM/service) privileges to write to protected program directories. Rooted in CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, a race condition), the flaw creates a time-of-check to time-of-use (TOCTOU) style window between when the updater validates a file and when it acts on it, allowing a local attacker to swap in a malicious file. The affected CPE is cpe:2.3:a:google:chrome, and the tags (Race Condition, Privilege Escalation, Microsoft/Windows) confirm this is a Windows-specific updater weakness rather than a browser-engine or renderer bug.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome on Windows to 151.0.7922.72 or later via the stable channel; most managed environments should confirm Chrome's automatic updates are enabled and have applied this build (advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). As a compensating control until the patched build is confirmed deployed, restrict local (interactive) access on multi-user Windows hosts and monitor the Chrome update directories for unexpected file writes, since the race requires a local attacker to place a malicious file during the update window; note this does not fully close the window and adds monitoring overhead. Avoid granting standard users write access to Chrome's installation or update staging paths.