CVE-2026-110150: Google Chrome Privilege Escalation Flaw

CVE-2026-110150 Overview

CVE-2026-110150 is a privilege elevation vulnerability in the Installer component of Google Chrome on Windows. The flaw affects Chrome versions prior to 155.0.8059.79 and is categorized under [CWE-250: Execution with Unnecessary Privileges]. A local attacker running a program on the target system can leverage the installer to obtain sensitive information. Google rates the Chromium security severity as High, while NVD assigns a medium CVSS score of 5.5. The vulnerability requires user interaction and local access, limiting remote exploitation potential.

Critical Impact
A local, unprivileged program can read sensitive information by abusing the Chrome installer's execution context on Windows systems running versions below 155.0.8059.79.

Affected Products

Google Chrome on Windows prior to 155.0.8059.79
Chromium-based builds using the affected installer component
Enterprise Chrome deployments on Windows endpoints pending the stable channel update

Discovery Timeline

2026-10-13 - CVE CVE-2026-110150 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110150

Vulnerability Analysis

The vulnerability resides in the Google Chrome Installer on Windows. The installer executes with elevated privileges during setup and update operations. A local attacker can introduce a program that interacts with the installer's execution context to disclose sensitive information. The weakness maps to [CWE-250], where a component runs with more privilege than required for its task. Exploitation does not grant integrity or availability impact, but confidentiality is affected because arbitrary data accessible to the installer context becomes exposed to the attacker.

Root Cause

The root cause is improper privilege separation within the Chrome installer on Windows. The installer performs operations with unnecessary privileges, enabling a lower-privileged local program to coerce it into surfacing data that would otherwise be inaccessible. See the Chromium Issue Tracker #561334760 for upstream tracking details.

Attack Vector

Exploitation requires local access to the Windows host and user interaction, such as triggering an installer action. An unprivileged program on the system interacts with the installer to retrieve sensitive data. The flaw is not remotely exploitable over the network. Refer to the Google Chrome Stable Update advisory for vendor-provided context on affected builds and the corrected version.

// No verified exploitation code is published. Technical details are
// restricted in the Chromium Issue Tracker entry referenced above.

Detection Methods for CVE-2026-110150

Indicators of Compromise

Unexpected invocations of Chrome installer binaries (setup.exe, GoogleUpdate.exe) by non-administrative processes.
Local processes reading installer-controlled paths under %ProgramFiles%\Google\Chrome\ or %LOCALAPPDATA%\Google\Update\.
File access patterns indicating sensitive data retrieval from installer temporary directories.

Detection Strategies

Monitor for installer processes spawned or interacted with by unexpected parent processes on Windows endpoints.
Hunt for Chrome versions below 155.0.8059.79 across managed Windows systems using endpoint inventory data.
Correlate local process creation events with file read operations targeting installer-owned directories.

Monitoring Recommendations

Enable Windows Sysmon process creation and file access logging on endpoints running Chrome.
Alert on local programs that enumerate or interact with Chrome update components outside expected update windows.
Track Chrome version compliance via software inventory and flag outdated installations.

How to Mitigate CVE-2026-110150

Immediate Actions Required

Update Google Chrome on all Windows systems to version 155.0.8059.79 or later.
Verify that Google Update is functioning and that managed endpoints have received the stable channel update.
Restrict local user ability to execute untrusted programs on endpoints where Chrome is installed.

Patch Information

Google released the fix in the stable channel update documented at the Google Chrome Stable Update advisory. Upgrade Chrome to version 155.0.8059.79 or later on Windows. Enterprise administrators should distribute the update via Chrome Browser Enterprise policies or standard patch management workflows.

Workarounds

No vendor-supplied workaround exists; applying the Chrome update is the authoritative mitigation.
Limit interactive logon rights on sensitive Windows hosts to reduce local attacker exposure.
Enforce application control policies to prevent unknown local binaries from executing alongside Chrome installer processes.

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion