EUVD-2026-100637
GHSA-j635-52v4-x2hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to Windows host
-
ExploitRun crafted local program
-
ExecutionTrigger over-privileged installer operation
-
ImpactRead sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires local code execution on a Windows host running Google Chrome with an installer version prior to 155.0.8059.79, plus user interaction (UI:R) to trigger the vulnerable installer path. Exploitation is bounded by the local attack vector (AV:L) - it cannot be performed remotely or over a network - and by the need for the attacker to already be able to run a local program. Impact is limited to disclosure of sensitive information (C:H), with no integrity or availability effect, so it functions as a local information-disclosure/privilege-boundary weakness rather than a remote compromise. |
| Impact | Signals align toward a moderate, non-urgent issue. CVSS 3.1 base score is 5.5 (Medium) with a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N) but mandatory user interaction (UI:R), and impact limited to confidentiality (C:H/I:N/A:N) - i.e. information disclosure rather than code execution. EPSS is very low at 0.11% (1st percentile), the CVE is NOT in CISA KEV, and no public exploit is identified. CISA SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a low-priority 'Track' disposition. The one notable inconsistency: the title/tags call this 'Privilege elevation' (and CWE-250, Execution with Unnecessary Privileges), yet the CVSS vector encodes no integrity or availability impact and only confidentiality loss - the realistic outcome is reading sensitive data via the installer's excess privileges, not full privilege takeover. Verify the precise impact with Google/Chromium. Overall this is a high-severity-label-but-moderate-real-risk local issue: patch via normal Chrome update cadence, not an emergency. |
| Exploit ScenarioDerived | A local attacker who can execute a program on a Windows machine running a vulnerable Chrome installer (prior to 155.0.8059.79) abuses the installer's unnecessary/elevated privileges to read sensitive information they otherwise could not access. Exploitation requires local presence plus user interaction (UI:R) to trigger the vulnerable installer flow. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local information disclosure in Google Chrome's installer component on Windows (versions prior to 155.0.8059.79) allows an attacker who can already run a local program to obtain sensitive information via the installer path, though user interaction is required to trigger the vulnerable flow. Rooted in execution with unnecessary privileges (CWE-250) and rated 5.5 (moderate), the issue carries an EPSS score of 0.11% (1st percentile) and no public exploit identified at time of analysis; CISA KEV does not list it and the SSVC decision framework rates exploitation as none. Google has released a vendor patch in Chrome 155.0.8059.79.
RemediationAI
Vendor-released patch: upgrade Google Chrome on Windows to version 155.0.8059.79 or later, using Chrome's built-in auto-update mechanism or by downloading the current stable build from Google; verify the installed version via chrome://version and confirm it is at or above 155.0.8059.79. The advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html provides the vendor's official guidance. Because the issue is local-only (AV:L) and requires an attacker to already run a local program plus user interaction (UI:R), network-level mitigations such as blocking ports or restricting remote access will not address it. If patching is delayed, compensating controls include running Chrome from a standard-user account rather than an administrative one, limiting which local users and processes can execute untrusted binaries on the host, and monitoring for unusual installer or privilege-boundary activity; these reduce the attack surface but may disrupt legitimate administrative workflows and do not eliminate the underlying unnecessary-privilege flaw. Disabling the installer entirely is not a practical workaround for most deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-250 (Execution with Unnecessary Privileges) describes the root cause: the Chrome installer on Windows performs operations at a privilege level beyond what is required, letting a local program invoked in the same context reach sensitive information that should be isolated. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning the attack is strictly local (AV:L), requires no prior authentication (PR:N), needs user interaction (UI:R), and affects only confidentiality (C:H) with no integrity or availability impact. The platform is Windows, matching the vendor advisory and the Google/Microsoft tags. No CPE strings were included in the input; the EUVD entry lists the affected Chrome boundary as versions below 155.0.8059.79, and the Chromium issue tracker reference (issues.chromium.org/issues/561334760) tracks the underlying bug.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local-only installer flaw needing a user-run program (AV:L, UI:R); no prior privileges needed (PR:N); outcome is sensitive-data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB