A race condition in the Google Chrome Updater for Windows allows a local attacker to escalate privileges, posing a significant risk to system integrity.

This vulnerability is a race condition (CWE-362) within the update mechanism of the browser. It allows an attacker with local access to the system to escalate their privileges by manipulating the update process through a malicious file.

Successful exploitation of this flaw allows a local, unprivileged attacker to gain elevated permissions on the host system. This could lead to a full compromise of the affected workstation, enabling data exfiltration, the installation of persistent malware, or unauthorized access to sensitive user information. While the CVSS score of 7.0 (High) reflects the requirement for local access and specific conditions, the potential for privilege escalation makes this a priority for enterprise environments.

Immediate Action: Update Google Chrome on all Windows systems to version 151.0.7922.72 or later to ensure the vulnerable updater component is patched.

Proactive Monitoring: Monitor local system logs for unusual process execution patterns or unauthorized file modifications within the Chrome update directory.

Compensating Controls: Implement strict file system permissions to restrict non-administrative users from writing to directories associated with browser updates and application binaries.

Public Exploit Available: No — no confirmed public exploit exists for this vulnerability.

The vulnerability presents a clear path for local privilege escalation, which is a common vector for lateral movement following an initial system breach. Security administrators should prioritize the deployment of the latest Chrome update across all Windows endpoints to eliminate this risk. Failure to patch may allow attackers to bypass standard user restrictions and gain full control over the local environment.