EUVD-2026-50610
GHSA-m293-xcr4-f6hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local user access
-
DeliveryPlant malicious file in updater path
-
ExploitUpdater processes unvalidated file (UI:R)
-
ExecutionEscalate to OS-level privileges
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires local access to the target system: the attacker must be able to place a malicious file that the Google Chrome Updater will process, and per the CVSS vector a user-interaction trigger (UI:R) is needed to invoke the vulnerable update path. Limiting factors are significant - the attacker must already have a foothold on the host to stage the file (AV:L), the flaw cannot be triggered remotely over the network, and Chrome versions 151.0.7922.72 and later are not affected. Authentication is CVSS PR:N (no privileges required beyond local presence), so any local user context suffices, but the requirement for local file placement plus an update trigger constrains this to post-access privilege escalation rather than initial compromise. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High), driven by a local attack vector, low complexity, no required privileges, but required user interaction, with high confidentiality, integrity, and availability impact - consistent with a privilege-escalation primitive rather than remote compromise. Google's own Chromium rating is only Medium, reflecting that exploitation requires prior local access and a triggering condition, which tempers real-world urgency. No EPSS score, POC, or KEV entry is present in the provided data, so there is no evidence of active or automated exploitation; this reads as a genuine but not emergency-priority local EoP that should be remediated on a normal patch cadence. The AV:L designation aligns with the description's 'local attacker' and 'malicious file' language, so the signals are internally consistent - the main tension is the High CVSS versus Google's Medium severity, which favors treating it as a moderate local-escalation risk. |
| Exploit ScenarioDerived | A local, low-privileged attacker (or malware already running as a standard user) plants a crafted malicious file where the privileged Chrome Updater will process it, then waits for or induces the triggering update action (user interaction, UI:R). When the Updater consumes the unvalidated file, the attacker escalates from user-level to OS-level privileges. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Local privilege escalation in Google Chrome's Updater component allows a local attacker who can plant a malicious file to gain OS-level privileges once the update process acts on it. The flaw stems from insufficient validation of untrusted input (CWE-20) and affects all Chrome desktop builds prior to 151.0.7922.72; Google rates the Chromium security severity as Medium while the CVSS base score is 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade the Chrome Stable channel to 151.0.7922.72 or later and relaunch the browser to complete the update, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, confirm the fixed build is deployed via your update management (Google Update policies / enterprise update infrastructure) since the vulnerable component is the Updater itself. As a compensating control until patched, restrict local write access to Chrome's installation and updater working directories so unprivileged users cannot stage a malicious file consumed by the privileged updater, and limit interactive local logon on shared or multi-user hosts; the trade-off is administrative overhead and potential interference with update staging, so validate that legitimate update operations still succeed after tightening permissions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the Chrome Updater, the background service (Google Update / GoogleUpdater) responsible for keeping the browser current and which typically runs with elevated/SYSTEM privileges to write into protected install directories. Because the Updater executes with higher privilege than the logged-in user, any point at which it consumes attacker-controllable input becomes a privilege boundary. The root cause is classified as CWE-20 (Improper Input Validation): the Updater insufficiently validates a file supplied by an untrusted local source, so a crafted malicious file processed by the privileged updater path can be leveraged to execute or write with the Updater's elevated rights. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering the Chrome desktop application across platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-planting attack (AV:L) requiring an update trigger (UI:R) but no prior privileges (PR:N), yielding full OS-level compromise, so C/I/A all High.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's update mechanism contains a local privilege escalation vulnerability affecting all desktop Chrome versions prior to 151.0.7922.72. While no public exploit has been identified at time of analysis, the vulnerability could enable attackers with local file access to gain operating system-level control, posing significant risk to organizational endpoints globally. Immediate patching is essential to prevent unauthorized privilege escalation and secure the enterprise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB