CVE-2026-13800: Google Chrome Privilege Escalation Flaw

CVE-2026-13800 Overview

CVE-2026-13800 is a local privilege escalation vulnerability in the Google Chrome Updater component on Windows. Chrome versions prior to 150.0.7871.47 contain an inappropriate implementation flaw that allows a local attacker to escalate privileges to the operating system level by placing a malicious file in a location processed by the updater. Google rates the Chromium security severity as High. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
A local attacker can achieve OS-level privilege escalation on Windows endpoints running vulnerable Chrome installations, gaining SYSTEM-level control over affected hosts.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Google Chrome Updater component on Windows
Microsoft Windows hosts running vulnerable Chrome builds

Discovery Timeline

2026-06-30 - CVE-2026-13800 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13800

Vulnerability Analysis

CVE-2026-13800 exists in the Google Chrome Updater on Windows. The Chrome Updater runs with elevated privileges to install and update the browser without user prompts. An inappropriate implementation in how the updater handles files allows a local attacker to abuse that trust boundary. Successful exploitation results in privilege escalation from a standard user context to OS-level privileges. The Chromium security team classified the issue as High severity, and Google addressed it in Chrome 150.0.7871.47 on the stable desktop channel.

Root Cause

The flaw is categorized as [CWE-284: Improper Access Control]. The updater does not sufficiently restrict access to or validate files it operates on with elevated privileges. A local user who plants a malicious file in a location processed by the updater causes the privileged updater process to act on attacker-controlled content. This crosses the security boundary between standard users and privileged system services on Windows.

Attack Vector

The attack requires local access to the target Windows host and user interaction, per the published CVSS metrics. An attacker with unprivileged local access places a malicious file where the Chrome Updater will process it. When the updater executes with elevated privileges, it interacts with the attacker-controlled file and grants the attacker code execution or file operations at the OS privilege level. No network access is required, and no synthetic exploit code is published. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for the vendor's technical references.

Detection Methods for CVE-2026-13800

Indicators of Compromise

Chrome Updater processes (GoogleUpdate.exe, updater.exe) accessing or executing files from user-writable directories.
Creation of unexpected files or symbolic links inside Chrome updater working directories by non-privileged users.
Child processes spawned by the Chrome Updater running as SYSTEM with non-Google signed binaries.

Detection Strategies

Monitor process lineage where the Chrome Updater service spawns non-Google-signed executables or command interpreters.
Alert on file writes by standard users into paths later consumed by the updater running under NT AUTHORITY\SYSTEM.
Correlate installations of Chrome versions below 150.0.7871.47 from endpoint inventory with local logon activity.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command line logging to capture updater activity.
Track Chrome version telemetry across the fleet and flag hosts running builds prior to 150.0.7871.47.
Review Sysmon file-create and process-create events involving the Chrome Updater directories.

How to Mitigate CVE-2026-13800

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 150.0.7871.47 or later.
Force-restart the browser after the update to ensure the patched updater components are loaded.
Audit endpoints for prior tampering with Chrome Updater directories and privileged process lineage.

Patch Information

Google released the fix in the Chrome stable channel update announced in the Google Chrome Desktop Update. Administrators should ensure Chrome auto-update is enabled or deploy 150.0.7871.47 through enterprise software distribution channels. Additional context is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict local logon rights on Windows endpoints to reduce the pool of users able to stage a malicious file.
Apply strict Access Control Lists (ACLs) on Chrome Updater working directories to block writes by non-administrative users.
Where feasible, temporarily disable the Chrome Updater service until patched builds are deployed, accepting the tradeoff of missed browser updates.

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via the updater command-line
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler