CVE-2026-17861: Google Chrome Privilege Escalation Flaw

CVE-2026-17861 Overview

CVE-2026-17861 is a local privilege escalation vulnerability in the Google Chrome Updater component. Insufficient validation of untrusted input allows a local attacker to trigger OS-level privilege escalation by supplying a malicious file. The flaw affects Google Chrome versions prior to 151.0.7922.72 and is categorized under [CWE-20] Improper Input Validation. Chromium security engineers rated the internal severity as Medium, while the NVD assigns a HIGH rating driven by the local attack vector and high impact on confidentiality, integrity, and availability.

Critical Impact
A local attacker who places a crafted file in a location processed by the Chrome Updater can escalate to OS-level privileges, gaining control over the affected host.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chrome Updater component across supported desktop platforms
Environments where the Chrome Updater runs with elevated privileges

Discovery Timeline

2026-07-30 - CVE-2026-17861 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17861

Vulnerability Analysis

The vulnerability resides in the Google Chrome Updater, the background component responsible for applying browser updates. The Updater accepts input from files placed on the local filesystem and fails to sufficiently validate that input before acting on it. Because the Updater runs with elevated privileges to install browser components, any input mishandling can translate directly into OS-level privilege escalation.

An attacker with local access can drop a malicious file into a location processed by the Updater. When the Updater consumes the file, the untrusted content influences privileged operations that should only be driven by trusted, vendor-signed data. The result is a path for a low-privileged user to execute actions in the security context of the Updater service.

Google addressed the issue in Chrome 151.0.7922.72 on the Stable channel. Full technical details are restricted per Chromium disclosure policy. See the Google Chrome Update announcement and the Chromium Issue Tracker Entry for vendor references.

Root Cause

The root cause is improper input validation ([CWE-20]) within the Updater's processing of file-based input. The Updater trusts attacker-controllable file content or metadata during operations that require elevated privileges, breaking the trust boundary between local user data and privileged installer logic.

Attack Vector

Exploitation requires local access to the target machine and user interaction to trigger the Updater workflow that processes the malicious file. No network access, credentials, or special privileges are needed before the attack begins. Successful exploitation yields code execution or file operations at the privilege level of the Chrome Updater service.

// No verified public proof-of-concept is available for CVE-2026-17861.
// The vulnerability is described in prose per the Chromium disclosure policy.
// See the Chromium Issue Tracker entry linked above for vendor references.

Detection Methods for CVE-2026-17861

Indicators of Compromise

Unexpected files placed in directories consumed by the Chrome Updater (GoogleUpdate, Google\Update, or platform equivalents on macOS and Linux).
Chrome Updater processes spawning unusual child processes such as command shells, scripting engines, or LOLBins.
Modifications to Chrome installation directories originating from non-installer, non-vendor processes.

Detection Strategies

Monitor process lineage where GoogleUpdate.exe, updater.exe, or the macOS GoogleUpdater binary spawns non-standard child processes.
Alert on file writes to Updater-controlled directories by unsigned or non-Google processes.
Track privilege transitions where a standard user session precedes SYSTEM or root activity attributed to the Updater.

Monitoring Recommendations

Ingest endpoint process, file, and integrity-level telemetry into a centralized analytics platform for correlation.
Baseline legitimate Chrome update activity so anomalous Updater executions stand out for review.
Review installed Chrome versions across the fleet and flag any host running a version earlier than 151.0.7922.72.

How to Mitigate CVE-2026-17861

Immediate Actions Required

Update all Google Chrome installations to version 151.0.7922.72 or later on every desktop platform.
Verify that the Chrome Updater service is functioning and has successfully applied the patched version.
Restrict local access on multi-user systems and enforce least-privilege for interactive accounts.

Patch Information

Google released the fix in Chrome Stable 151.0.7922.72. Deploy the patched build through managed software distribution or allow the Chrome Updater to complete the automatic upgrade. Confirm the running version through chrome://settings/help or an inventory query. Additional vendor context is available in the Google Chrome Update release notes.

Workarounds

No official workaround exists; patching to 151.0.7922.72 is the supported remediation.
Limit local logon rights and remove unnecessary standard-user access on shared or high-value endpoints until patching completes.
Enforce application control policies that block unsigned executables from writing to Chrome Updater directories.

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version