CVE-2024-3173 Overview
CVE-2024-3173 is an input validation vulnerability in the Updater component of Google Chrome prior to version 120.0.6099.62. The flaw allows a remote attacker to achieve OS-level privilege escalation by convincing a user to open a malicious file. Chromium rates the security severity as High. The vulnerability is classified under [CWE-345] (Insufficient Verification of Data Authenticity) and [CWE-20] (Improper Input Validation).
Critical Impact
Successful exploitation enables OS-level privilege escalation on the host system, granting an attacker elevated permissions beyond the browser sandbox.
Affected Products
- Google Chrome versions prior to 120.0.6099.62
- Google Chrome Updater component
- Chromium-based builds inheriting the vulnerable Updater
Discovery Timeline
- 2024-07-16 - CVE-2024-3173 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3173
Vulnerability Analysis
The Google Chrome Updater is a privileged component responsible for retrieving and applying browser updates. It runs with elevated permissions to modify browser binaries on disk. Insufficient data validation in this component permits a remote attacker to supply a malicious file that the Updater processes without proper verification. The result is OS-level privilege escalation, meaning an attacker can gain permissions beyond those of the browser process.
Exploitation requires user interaction, as the attack vector depends on the victim engaging with the malicious file. Once triggered, the flaw compromises confidentiality, integrity, and availability of the affected system.
Root Cause
The root cause combines [CWE-345] and [CWE-20]. The Updater fails to sufficiently verify the authenticity of input data before acting on it. Missing or incomplete input validation allows attacker-controlled data to influence a privileged code path. Because the Updater executes with higher privileges than the browser, unchecked input becomes a route to system-level compromise.
Attack Vector
The attack originates over the network and requires user interaction. An attacker crafts a malicious file that the Updater subsequently processes. When the victim triggers the update flow with the malicious payload in place, the Updater performs privileged operations based on untrusted data. This produces privilege escalation outside the Chrome sandbox.
No verified public exploit code or proof-of-concept is available. See the Chromium Issue Tracker entry for technical background.
Detection Methods for CVE-2024-3173
Indicators of Compromise
- Unexpected child processes spawned by the Google Chrome Updater (GoogleUpdater, updater.exe) writing to protected directories.
- Modification of files under Chrome installation paths outside of scheduled update windows.
- Elevation events where the Updater service performs file operations on attacker-controlled paths.
Detection Strategies
- Inventory browser versions across the fleet and flag any host running Chrome earlier than 120.0.6099.62.
- Monitor the Chrome Updater process tree for anomalous file reads, writes, or execution of non-Google-signed binaries.
- Correlate browser download activity with subsequent Updater invocations to identify attacker-supplied files reaching the privileged component.
Monitoring Recommendations
- Enable endpoint telemetry that captures process lineage, command-line arguments, and file-write events for the Chrome Updater.
- Alert on privilege escalation events where a browser-adjacent process obtains SYSTEM or root-equivalent privileges.
- Ingest Chrome update logs into a central log platform and baseline expected update behavior per host.
How to Mitigate CVE-2024-3173
Immediate Actions Required
- Update Google Chrome to version 120.0.6099.62 or later on all endpoints.
- Verify the Chrome Updater component is running the patched build after upgrade.
- Restrict user permissions where feasible to reduce the impact of successful privilege escalation.
Patch Information
Google fixed the issue in Chrome Stable channel version 120.0.6099.62. Refer to the Google Chrome Desktop Update advisory and the Chromium Issue Tracker entry for release details.
Workarounds
- No vendor-supplied workaround exists; upgrading to the fixed version is the required remediation.
- Enforce enterprise policy that mandates automatic Chrome updates through management tooling.
- Block execution of untrusted files delivered via the browser using application control policies until patching completes.
# Verify installed Chrome version meets or exceeds the fixed release
google-chrome --version
# Expected output: Google Chrome 120.0.6099.62 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
