CVE-2024-7977: Google Chrome Privilege Escalation Flaw

CVE-2024-7977 Overview

CVE-2024-7977 is a local privilege escalation vulnerability in the Google Chrome installer on Windows. The flaw stems from insufficient data validation in the installer component. A local attacker can exploit the vulnerability by planting a malicious file that the installer processes without adequate validation. Successful exploitation allows the attacker to elevate privileges on the affected Windows host.

The issue affects Google Chrome versions prior to 128.0.6613.84 on Windows. Google addressed the vulnerability in the Stable channel update released on August 21, 2024. The Chromium project rated the underlying issue as Medium severity, while the NVD assigned a HIGH rating based on the local integrity and confidentiality impact.

Critical Impact
A local attacker with the ability to write a malicious file to a predictable path can escalate privileges through the Chrome installer, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Google Chrome on Windows prior to 128.0.6613.84
Microsoft Windows hosts running vulnerable Chrome installer versions
Environments performing Chrome installation or update operations from user-writable locations

Discovery Timeline

2024-08-21 - Google releases Stable Channel update for desktop containing the fix
2024-08-21 - CVE-2024-7977 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7977

Vulnerability Analysis

The vulnerability is classified as an Improper Input Validation issue [CWE-20] in the Chrome installer on Windows. The installer processes files during setup, update, or elevation operations without sufficiently validating file contents or origin. An attacker who can stage a crafted file in a location the installer reads gains a path to execute code or perform actions in the installer's security context.

Because the Chrome installer runs with elevated privileges during parts of its workflow, insufficient validation of file input translates directly into privilege escalation. The attack requires local access and user interaction, but no prior privileges on the target host. The result is full compromise of the user session and, depending on installer state, of SYSTEM-level operations tied to Chrome's update service.

See the Chromium Issue Tracker Entry for the upstream discussion referenced by Google.

Root Cause

The root cause is missing or incomplete validation of data consumed by the installer. The installer trusts input that a local, unprivileged user can control. Without integrity checks, path validation, or provenance enforcement, the elevated installer acts on attacker-supplied content.

Attack Vector

Exploitation is local. An attacker with unprivileged access to the Windows host stages a malicious file where the Chrome installer will read it. The attacker then triggers an install, update, or repair operation, which typically requires user interaction. The installer processes the malicious file under elevated privileges and executes attacker-influenced logic. No verified public proof-of-concept is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Google Chrome Update Announcement for vendor detail.

Detection Methods for CVE-2024-7977

Indicators of Compromise

Unexpected files staged in Chrome installer working directories or user-writable paths referenced by setup.exe or Google Update components
Chrome installer or GoogleUpdate.exe spawning child processes that are not signed by Google LLC
New services, scheduled tasks, or registry Run entries created immediately following a Chrome install or update event

Detection Strategies

Alert on process creation where the parent is setup.exe, chrome_installer.exe, or GoogleUpdate.exe and the child process is cmd.exe, powershell.exe, rundll32.exe, or an unsigned binary
Monitor for writes to Chrome installer staging directories by non-Google processes prior to installer execution
Correlate elevation prompts for Chrome installer components with recent file writes into those same paths by non-administrative users

Monitoring Recommendations

Inventory Chrome versions across managed Windows endpoints and flag any host below 128.0.6613.84
Forward Sysmon Event IDs 1 (process create), 11 (file create), and 13 (registry set) covering Chrome installer paths to a central log store
Track update service anomalies, including failed installs, unexpected rollbacks, and installer executions outside maintenance windows

How to Mitigate CVE-2024-7977

Immediate Actions Required

Update Google Chrome to version 128.0.6613.84 or later on all Windows endpoints
Verify that Google Update is functioning and that endpoints are pulling the Stable channel build
Restrict local user write access to directories used by the Chrome installer and update service
Audit endpoints for unexpected files or persistence created during recent Chrome install or update events

Patch Information

Google released the fix in the Stable Channel Update for Desktop on August 21, 2024, shipping Chrome 128.0.6613.84 for Windows. Enterprise administrators should deploy the update through Google Chrome Enterprise, Microsoft Intune, Configuration Manager, or the update mechanism in use. See the Google Chrome Update Announcement for release detail.

Workarounds

Enforce standard-user separation and remove local administrator rights where feasible to raise the bar for staging malicious files
Apply application control policies such as Windows Defender Application Control or AppLocker to block execution of unsigned binaries launched by installer processes
Restrict interactive access on high-value Windows hosts until the patched Chrome build is deployed

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Google Update to check for the patched build
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler