CVE-2026-17993 Overview
CVE-2026-17993 is a race condition vulnerability in the Updater component of Google Chrome on Windows. Versions prior to 151.0.7922.72 are affected. The flaw allows a local attacker to escalate privileges by staging a malicious file that wins a race with the updater process. Chromium rates the security severity as Low, but the impact remains privilege escalation on the local host. The issue is classified under CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization.
Critical Impact
A local attacker who can place files at a monitored path can exploit the updater race to gain elevated privileges on Windows endpoints running vulnerable Chrome builds.
Affected Products
- Google Chrome on Windows prior to 151.0.7922.72
- Chromium Updater component on Windows
- Downstream Chromium-based browsers that ship the same Updater on Windows
Discovery Timeline
- 2026-07-30 - CVE-2026-17993 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17993
Vulnerability Analysis
The vulnerability resides in the Chrome Updater on Windows. The Updater runs with elevated privileges to install and maintain browser binaries. A race condition in this process lets a local, unprivileged attacker interpose a malicious file during a narrow execution window. When the Updater proceeds without adequately synchronizing access to the shared resource, the attacker-controlled file is used in place of the trusted one. The result is code execution or file operations under the Updater's privilege context, producing a local privilege escalation.
Root Cause
The root cause is improper synchronization on a shared resource during update operations, mapped to [CWE-362]. The Updater performs a sequence of check and use steps on a file path without holding an atomic lock across both operations. This creates a Time-of-Check to Time-of-Use (TOCTOU) window that a local attacker can exploit by swapping the target file between the check and the use.
Attack Vector
The attack requires local access to the Windows host. The attacker plants or replaces a file the Updater consumes and triggers or waits for an update cycle. Winning the race causes the privileged Updater to act on the malicious file. See the Chrome Stable Update Announcement and the Chromium Issue Tracker Entry for vendor context. No public exploit code is available for CVE-2026-17993, and no verified proof-of-concept has been released.
Detection Methods for CVE-2026-17993
Indicators of Compromise
- Unexpected file writes, renames, or symlink creations in the Chrome Updater working directories under %ProgramFiles%\Google\ or %LOCALAPPDATA%\Google\Update\.
- Child processes spawned by the Chrome Updater service that do not match signed Google binaries or expected update payloads.
- New or modified executables appearing in updater staging paths immediately before or during an update cycle.
Detection Strategies
- Monitor for non-Google processes creating or modifying files in Chrome Updater directories on Windows endpoints.
- Alert on process creation chains where GoogleUpdater.exe or related updater binaries execute unsigned or unexpected child processes.
- Correlate file system events on updater paths with the timing of Chrome update checks to identify TOCTOU exploitation attempts.
Monitoring Recommendations
- Track installed Chrome versions across the fleet and flag hosts below 151.0.7922.72.
- Enable Windows file system auditing on Chrome Updater directories and forward events to a central log store.
- Review privilege escalation telemetry from local user contexts on endpoints that recently ran Chrome updates.
How to Mitigate CVE-2026-17993
Immediate Actions Required
- Update Google Chrome on Windows to version 151.0.7922.72 or later on all endpoints.
- Verify that the Chrome Updater service is running the patched build and confirm the version post-restart.
- Restrict local logon rights on shared or multi-user Windows hosts to reduce the population of potential local attackers.
Patch Information
Google released the fix in Chrome Stable 151.0.7922.72 for Windows. Deploy the update through managed software distribution, Group Policy, or the built-in Chrome update mechanism. Confirm the fix through the Chrome Stable Update Announcement and the Chromium Issue Tracker Entry.
Workarounds
- No vendor-supplied workaround is documented; apply the patch as the primary remediation.
- Limit interactive local access to Windows endpoints where Chrome is installed to reduce exposure to local attackers.
- Enforce application control policies that block unsigned executables from launching in Chrome Updater staging directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
