EUVD-2026-50780
GHSA-vmw9-hq9j-9x52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local unprivileged access on macOS
-
DeliveryPlant malicious file in updater path
-
ExploitTrigger privileged Chrome update
-
ExecutionWin race in Updater (CWE-362)
-
PersistPrivileged updater acts on malicious file
-
ImpactOS-level privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the macOS host and the ability to plant a malicious file that the Google Chrome Updater processes, then to win the CWE-362 race condition timing window during a privileged update operation. The CVSS vector's UI:R means user interaction (or a triggered update action) is required, and AV:L confirms this is not remotely exploitable - an attacker must already have local code execution or a local account. Limiting factors: the target must be running a vulnerable Chrome build (< 151.0.7922.72) on macOS specifically, the attacker must have write access to the relevant updater-controlled path, and reliably winning the race may require multiple attempts, which constrains real-world exploitation to already-present local threats rather than remote attackers. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) indicates local access (AV:L) with low complexity, no privileges required, but mandatory user interaction (UI:R), and high impact to confidentiality, integrity, and availability - consistent with a local EoP rather than a remote compromise. Chromium's internal 'Critical' severity outranks the numeric 7.8, but that Chromium scale weights exploit primitive quality, not deployment-wide risk. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced. The signals are internally consistent: this is a genuine, vendor-confirmed local privilege-escalation bug worth prompt patching, but absent KEV/POC it is not an emergency remote-exploitation event. One nuance to verify: race conditions often warrant higher attack complexity, yet NVD/vendor scored AC:L - treat exploitation as reliably achievable given Google's Critical rating. |
| Exploit ScenarioDerived | A local, unprivileged user (or malware already running at user level) plants a crafted malicious file in a location the Chrome Updater processes, then races the privileged update operation to win the timing window between validation and use. Winning the race causes the elevated updater to act on the attacker's file, granting OS-level privileges. No public exploit is identified at time of analysis, and success requires the local user interaction reflected in UI:R. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Chrome Stable channel; the fix is documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome updates apply through the same Updater component involved here, verify the update actually completed (Chrome menu → About Google Chrome forces an update check and relaunch) rather than assuming background auto-update ran. As a compensating control until patched, restrict local access to shared/writable locations the updater relies on and limit which local users can drop files onto the endpoint, since exploitation requires a local attacker to place a malicious file - the trade-off is that tightening local filesystem permissions offers only partial mitigation and does not close the race window itself, so patching is the only reliable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Google Chrome Updater component, the privileged auto-update mechanism (on macOS, historically the Keystone/GoogleUpdater service) that runs with elevated rights to install browser updates. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization - a race condition) is the root cause: a window exists between a check and a use (e.g., file validation and file operation) that a local attacker can interleave with a malicious file to cause the privileged updater to act on attacker-controlled content, yielding OS-level privilege escalation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected application is Google Chrome, specifically its macOS build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attack requiring a malicious file and user interaction, with AC:H because winning the CWE-362 race is a timing-dependent condition; full CIA impact via privilege escalation.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome's Updater on macOS versions before 151.0.7922.72 can be exploited by attackers with local system access to gain administrative privileges, potentially taking over affected machines. This directly threatens organizations where macOS systems store sensitive data or access critical applications-one compromised Mac could become a pivot point for broader network access. Rapid patching prevents this escalation path from materializing.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB