Google Chrome EUVD-2026-34564

The attacker must already have local code execution on the Windows host as a standard user, must be able to write a malicious file to a location the Chrome Installer reads from during install/update/repair, and must wait for or trigger an Installer run (typically a Chrome update cycle or user-initiated reinstall). Exploitation is limited to Windows builds of Chrome below 149.0.7827.53 - macOS and Linux are not affected. The CVSS UI:R component means a user action (such as launching Chrome to trigger an update, or invoking the installer) is required to consummate the privilege escalation, which constrains opportunistic mass exploitation.

Signals are largely aligned and point to a real but low-urgency issue. CVSS 7.8 reflects high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) with local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and required user interaction (UI:R). CISA's SSVC framework rates Exploitation as none, Automatable as no, and Technical Impact as total - consistent with a high-impact but manually-triggered local flaw. EPSS at 0.01% (1st percentile) reinforces that mass exploitation is unlikely, and the CVE is not on CISA KEV. The combination of local-only vector, required user interaction, and the absence of public exploit code makes this a patch-on-normal-cadence issue rather than an emergency. One notable nuance: PR:N with UI:R means the attacker themselves needs no privileges, but they must induce a user (or the Installer running on the user's behalf) to interact with the malicious file - typically a file-planting scenario.

A low-privileged local user (or malware running in their context) plants a malicious file in a directory the Chrome Installer searches during an update or repair operation. When the Installer next runs with elevated privileges and processes the planted file, the attacker's code or configuration is executed at SYSTEM or administrator level, granting full OS-level privilege escalation. No public exploit identified at time of analysis, but the file-planting pattern against Windows installers is a well-understood and reproducible technique.