CVE-2026-17864: Chrome Updater Privilege Escalation Flaw

CVE-2026-17864 Overview

CVE-2026-17864 affects the Google Chrome Updater component on macOS. The flaw stems from an inappropriate implementation that allows a local attacker to escalate privileges to the operating system level using a malicious file. Google Chrome versions prior to 151.0.7922.72 on Mac are affected. Chromium classifies the security severity as Medium, while NVD scores it 7.8 (High) using vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness maps to CWE-269: Improper Privilege Management. Successful exploitation grants the attacker OS-level privileges on the affected Mac host.

Critical Impact
A local attacker who convinces a user to interact with a malicious file can achieve OS-level privilege escalation through the Chrome Updater on macOS.

Affected Products

Google Chrome for macOS versions prior to 151.0.7922.72
Chrome Updater component on macOS
Any macOS system running a vulnerable Chrome build with the auto-update service enabled

Discovery Timeline

2026-07-30 - CVE-2026-17864 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17864

Vulnerability Analysis

The vulnerability resides in the Google Chrome Updater on macOS. The Updater runs with elevated privileges to install browser updates system-wide. An inappropriate implementation in how the Updater processes files enables a local attacker to bridge from a user-level context into an OS-level privileged context. The flaw requires local access and user interaction, consistent with the AV:L/UI:R attack characteristics, but yields full confidentiality, integrity, and availability impact once exploited. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor-provided details.

Root Cause

The root cause is improper privilege management [CWE-269] in the Updater. The component does not enforce sufficient controls when handling attacker-supplied file input during its update or installation workflow. As a result, actions performed by a low-privileged user can influence operations executed by the privileged Updater process on macOS.

Attack Vector

Exploitation is local. An attacker with a foothold on the macOS system places a malicious file that the Chrome Updater processes. When the Updater interacts with that file under its elevated context, the attacker gains OS-level privileges. User interaction is required, which typically means the victim triggers an update flow or executes a launcher that engages the Updater.

No verified public proof-of-concept code is available. See the Chromium Issue Tracker Entry for the technical details maintained by the Chrome security team.

Detection Methods for CVE-2026-17864

Indicators of Compromise

Unexpected files placed in Chrome Updater working directories such as /Library/Google/GoogleUpdater/ or ~/Library/Google/GoogleUpdater/
New or modified LaunchDaemons or LaunchAgents referencing GoogleUpdater outside of a legitimate Chrome install or update event
Processes spawned by GoogleUpdater that execute shells, scripting interpreters, or write to system-owned paths
Chrome installations reporting a version older than 151.0.7922.72 after a claimed successful update

Detection Strategies

Inventory macOS endpoints and flag Google Chrome builds below 151.0.7922.72
Monitor child processes of the Chrome Updater binary for anomalous execution such as /bin/sh, osascript, or bash
Alert on writes by non-privileged users to files subsequently consumed by the privileged Updater process
Correlate file creation events in Updater directories with a following privilege transition to root

Monitoring Recommendations

Enable macOS Endpoint Security telemetry for process execution, file creation, and privilege changes on all managed Macs
Track Chrome version telemetry from managed device inventories and compare against the fixed build
Review LaunchDaemon and LaunchAgent modifications on a scheduled cadence
Retain Updater logs from ~/Library/Application Support/Google/GoogleUpdater/ for forensic review

How to Mitigate CVE-2026-17864

Immediate Actions Required

Update Google Chrome on macOS to version 151.0.7922.72 or later on every managed and unmanaged endpoint
Verify the installed Chrome version after update by checking chrome://settings/help
Restrict local access to macOS systems used by privileged users until patching is confirmed
Audit Chrome Updater directories for unauthorized files created before the patch was applied

Patch Information

Google addressed the flaw in the Chrome Stable channel release documented in the Google Chrome Update Announcement. The fixed version for macOS is 151.0.7922.72. Deploy the update through your standard software distribution mechanism or allow Chrome's built-in updater to complete once the patched build has propagated.

Workarounds

No vendor-supplied workaround exists; apply the patched build as the primary remediation
Limit interactive login access on shared Macs to reduce local attacker opportunities
Enforce least privilege on macOS user accounts to constrain pre-exploitation activity
Restrict write access to Chrome Updater directories where operationally feasible

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome to check for updates via the Updater CLI
/Library/Google/GoogleUpdater/current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --wake