CVE-2026-18018: Google Chrome Updater UI Spoofing Flaw

CVE-2026-18018 Overview

CVE-2026-18018 is a user interface (UI) spoofing vulnerability in the Updater component of Google Chrome on Windows. The flaw affects versions prior to 151.0.7922.72 and stems from an inappropriate implementation that a local attacker can abuse using a malicious file. Google classifies the Chromium security severity as Low.

Exploitation requires local access and delivery of a crafted file, so this issue is more relevant to social engineering scenarios than remote compromise. Even so, spoofed updater dialogs can trick users into approving actions they would otherwise reject.

Critical Impact
A local attacker can present a spoofed Chrome updater interface to a user through a malicious file, enabling deception that supports further social engineering.

Affected Products

Google Chrome on Windows versions prior to 151.0.7922.72
Chromium-based components using the affected Updater implementation on Windows
Downstream Chromium-derived browsers on Windows that inherit the Updater code before the fix

Discovery Timeline

2026-07-30 - CVE-2026-18018 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18018

Vulnerability Analysis

The issue resides in the Chrome Updater component on Windows. According to Google, an inappropriate implementation permits a local attacker to perform UI spoofing when a malicious file is introduced to the system. The Updater is a privileged, user-facing component responsible for keeping the browser current, which makes any spoofing of its interface a credible pretext for tricking users.

UI spoofing vulnerabilities fall under user interface confusion issues, where the attacker controls what a user sees but not necessarily what the software does behind the scenes. In this case, the attacker leverages the trust users place in updater dialogs to increase the likelihood a victim will accept a subsequent action.

Google addressed the issue in Chrome 151.0.7922.72 on the Stable channel for Windows. Refer to the Chrome Stable channel update and Chromium Issue Tracker #524467747 for the vendor references.

Root Cause

The root cause is an inappropriate implementation in the Chrome Updater on Windows. The component does not sufficiently constrain how content sourced from a malicious file is rendered or interpreted, allowing an attacker to influence UI elements displayed to the user.

Attack Vector

The attack vector is local. An attacker must place a malicious file on the target system, for example by way of a download, an email attachment, or a removable device. When the Updater processes or interacts with the file, it renders a misleading UI that a user could act on. No network-based, unauthenticated exploitation path is described in the advisory.

No public proof-of-concept exploit is referenced in the advisory. See the Chromium Issue Tracker entry for technical details as Google unrestricts the bug.

Detection Methods for CVE-2026-18018

Indicators of Compromise

Unexpected files placed in user-writable paths associated with the Chrome Updater on Windows, particularly paths under %LOCALAPPDATA%\Google\Update and %PROGRAMFILES(X86)%\Google\Update
Chrome versions on Windows endpoints reporting as older than 151.0.7922.72 after the patch release window
User reports of unusual Chrome update prompts, dialogs, or install confirmations that do not match the standard updater flow

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build below 151.0.7922.72
Monitor process execution and file writes involving GoogleUpdate.exe and updater.exe originating from non-standard paths
Correlate malicious file delivery events (email, download, USB) with subsequent Chrome Updater activity on the same host

Monitoring Recommendations

Track Chrome auto-update telemetry from managed endpoints to confirm version rollout after patching
Alert on user-initiated execution of files that then trigger UI activity from the Chrome Updater process
Feed browser and endpoint telemetry into a centralized data lake to enable retrospective hunts once additional indicators emerge from the Chromium issue tracker

How to Mitigate CVE-2026-18018

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 151.0.7922.72 or later
Verify that Chrome auto-update is enabled and functioning across the fleet
Communicate to users that legitimate Chrome updates do not require running downloaded executables and that they should report unexpected updater prompts

Patch Information

Google released the fix in the Chrome Stable channel for Windows at version 151.0.7922.72. Details are available in the Chrome Stable channel update announcement. Restart the browser after the update installs to complete deployment.

Workarounds

Restrict execution of untrusted files delivered via email, web downloads, or removable media using application control on Windows
Educate users to close and ignore any Chrome update dialog that appears after opening a downloaded file, and to trigger updates only from chrome://settings/help
Where feasible, enforce Chrome update policies via enterprise management so users cannot defer or bypass the patched version

bash

# Configuration example: enforce minimum Chrome version via Windows Group Policy registry keys
# Requires the Chrome ADMX templates to be installed
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "151.0.7922.72" /f