CVE-2026-7990: Google Chrome Privilege Escalation Flaw

CVE-2026-7990 Overview

CVE-2026-7990 is a local privilege escalation vulnerability in the Google Chrome Updater component on Windows. The flaw stems from insufficient validation of untrusted input, classified under [CWE-20]. A local attacker can supply a malicious file to the Updater and elevate privileges to the operating system level. The issue affects Google Chrome on Windows prior to version 148.0.7778.96. Exploitation requires local access and user interaction, but successful abuse yields high impact to confidentiality, integrity, and availability.

Critical Impact
A local attacker who places a malicious file in a path processed by the Chrome Updater can escalate privileges to the OS level on Windows hosts running Chrome before 148.0.7778.96.

Affected Products

Google Chrome on Windows prior to 148.0.7778.96
Microsoft Windows hosts running vulnerable Chrome builds
Chrome Updater component (GoogleUpdate) on Windows

Discovery Timeline

2026-05-06 - CVE-2026-7990 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7990

Vulnerability Analysis

The Chrome Updater on Windows runs with elevated privileges to install and apply browser updates. The component fails to sufficiently validate untrusted input from files it processes during update operations. An attacker with local access supplies a crafted file that the privileged Updater consumes, causing the Updater to perform actions on behalf of the attacker in a higher security context. The result is OS-level privilege escalation from a standard local user to a privileged account. Google rates the Chromium security severity as Medium, while NVD assigns a higher base score driven by the high impact metrics.

Root Cause

The root cause is improper input validation [CWE-20] in the Chrome Updater on Windows. The Updater accepts file content without enforcing the trust boundary between unprivileged user contexts and the privileged update workflow. Because the Updater operates with elevated rights, any logic that consumes attacker-controlled file data without strict validation can be coerced into privileged actions. Google addressed the defect in Chrome 148.0.7778.96 on the Stable channel.

Attack Vector

Exploitation requires local access to the target Windows host and user interaction. The attacker stages a malicious file in a location read or processed by the privileged Updater workflow. When the Updater processes the file, the insufficient validation allows the attacker to influence privileged operations and gain OS-level rights. The vulnerability cannot be triggered remotely without a foothold on the system. For technical context, refer to the Chromium Issue Tracker entry #498892267 and the Google Chrome stable channel update announcement.

Detection Methods for CVE-2026-7990

Indicators of Compromise

Unexpected files written to directories used by the Chrome Updater (GoogleUpdate.exe, updater.exe) prior to update events.
New privileged processes spawned as children of the Chrome Updater service outside normal update windows.
Modifications to Chrome Updater scheduled tasks or service configuration by non-administrative users.

Detection Strategies

Hunt for non-standard file drops in Chrome Updater working directories followed by Updater execution.
Correlate standard-user file write events with subsequent privileged process creation under the Updater process tree.
Alert on Chrome versions reported by endpoints that remain below 148.0.7778.96 after the patch release.

Monitoring Recommendations

Monitor process creation telemetry for GoogleUpdate.exe child processes running as SYSTEM with unusual command lines.
Track integrity-level transitions where low or medium integrity user activity precedes high integrity Updater actions.
Maintain inventory of Chrome versions across managed Windows endpoints and flag installations below 148.0.7778.96.

How to Mitigate CVE-2026-7990

Immediate Actions Required

Update Google Chrome on all Windows endpoints to 148.0.7778.96 or later via the Stable channel.
Verify that the Chrome Updater service and scheduled tasks are enabled so the patch deploys automatically.
Audit Windows hosts for outdated Chrome installations and prioritize remediation on multi-user systems.

Patch Information

Google released the fix in Chrome 148.0.7778.96 on the Stable channel for Windows. Details are documented in the Google Chrome stable channel update announcement. Enterprises using managed Chrome deployments should confirm patch rollout through their update management tooling.

Workarounds

Restrict local interactive logon on sensitive Windows hosts to reduce exposure to local-only attacks.
Enforce least privilege so standard users cannot stage files in directories consumed by the Chrome Updater.
Apply application control policies to block execution of unauthorized files from user-writable paths.

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler