EUVD-2026-74498
GHSA-m2w2-w93c-rhg3
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Local-only vector with race condition complexity; PR:N since any local process can attempt the race; S:C reflects sandbox escape to host OS.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
AnalysisAI
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker already has local code execution on the target Windows machine - this is a hard prerequisite; (2) Google Chrome is installed and the Chrome Updater service or process is present and triggerable on that machine; (3) the attacker's program must win a race condition, meaning exploitation timing is inherently probabilistic and may require multiple attempts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H produces a score of 8.1, reflecting the local-access requirement and high attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome for Windows to version 153.0.8010.36 or later via the stable channel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, distribute Chrome version 153.0.8010.36 or later to all Windows endpoints via enterprise update mechanisms; ensure auto-update is enabled if not already managed centrally. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today