Google Chrome EUVD-2026-28083

Requires local access to a Windows system running vulnerable Chrome version (pre-148.0.7778.96) and user interaction (UI:R) to trigger the updater's processing of a malicious file. The attacker must deliver a specially crafted file to the target system and either trick a user into manually initiating an update operation involving that file or place the file where Chrome's automatic updater will process it during routine update checks. No special administrative privileges required (PR:N) for the initial attack, though the target updater process must be running with elevated privileges (standard Chrome updater configuration on Windows). Exploitation is limited to Windows platforms only - Chrome updater implementations on macOS, Linux, and other operating systems use different code paths not affected by this vulnerability. User interaction requirement significantly constrains remote or automated exploitation scenarios, making this primarily a concern for targeted attacks, insider threats, or post-exploitation privilege escalation after initial compromise via other vectors.

Real-world risk assessment reveals moderate enterprise concern despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates low attack complexity but requires both local access and user interaction, significantly constraining mass exploitation scenarios. The vulnerability enables full compromise (C:H/I:H/A:H) but only after an attacker establishes initial local access and convinces a user to interact with a malicious file - likely through social engineering or physical access. No EPSS score provided in available data, and absence from CISA KEV suggests this has not been observed in active widespread exploitation. The medium Chromium severity rating (rather than high/critical) aligns with the local-only attack surface. Primary risk exists in environments with delayed patching cycles, shared workstations, or where attackers already have low-privileged access (e.g., compromised user accounts, insider threats). The Chrome auto-update mechanism should mitigate risk for most consumer users within days, but enterprise deployments with managed update policies may remain vulnerable longer. SSVC assessment: exploitation status is POC-possible but not confirmed public; automatable is NO due to UI:R requirement; technical impact is total system compromise.

An attacker with local access to a Windows system (e.g., compromised low-privilege user account, physical access to unlocked workstation, or malware with limited user-level persistence) crafts a malicious file designed to exploit input validation flaws in Chrome's updater. The attacker places this file in a location where the Chrome updater will process it or socially engineers a legitimate user into triggering the update process with the malicious file as input (e.g., via a fake update prompt or file association hijacking). When the user interacts with the file or initiates an update, the Chrome updater running with SYSTEM privileges processes the malicious input without proper validation, allowing the attacker to execute arbitrary code with elevated privileges, effectively gaining full administrative control over the Windows system. No public proof-of-concept code identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation is straightforward once local access is established.