Google Chrome CVE-2026-7997

Requires local access to a macOS system running Chrome prior to 148.0.7778.96. User interaction (UI:R) is mandatory - the victim must actively open, execute, or otherwise interact with the attacker-supplied malicious file. The attacker does not need existing privileges (PR:N indicates no authentication required beyond normal user access), but must already have the ability to place files on the target system and convince the user to interact with them. The vulnerability is limited to macOS platforms specifically, as it resides in the Mac-specific Updater component - Windows and Linux Chrome installations using different updater implementations are not affected. The low attack complexity (AC:L) suggests no additional specialized conditions like race conditions or non-default configurations are required once the attacker has met the local access and user interaction prerequisites.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local access with low complexity but critically requires user interaction, meaning an attacker must already have local access and convince a user to interact with a malicious file. No EPSS score, KEV listing, or public exploit code is present in available data, suggesting this has not been exploited in the wild. The contradiction between CVSS 7.8 (High) and Google's 'Low' severity rating reflects different risk models: CVSS measures theoretical impact assuming exploitation succeeds, while Google's rating considers real-world likelihood given the local attack vector and UI requirement. For enterprise defenders, this is a standard patch priority rather than an emergency - the attacker must already have local access and social engineering capability, which are significant barriers. The lack of remote exploitation paths and the rapid patch availability (same-day release) further reduce urgency compared to remotely exploitable Chrome vulnerabilities.

An attacker with local access to a macOS system (e.g., through compromised user credentials, physical access, or initial foothold from phishing) crafts a malicious file designed to exploit the Updater's input validation flaw. The attacker uses social engineering to convince the victim to interact with this file, perhaps disguising it as a legitimate document or software installer. When the user opens or processes the file, Chrome's Updater component handles it with insufficient validation, allowing the malicious payload to execute with the Updater's elevated privileges, granting the attacker OS-level administrative access to install persistent malware, modify system configurations, or access privileged data.