A high-severity authorization bypass vulnerability in Google Chrome on Windows allows local attackers to escalate privileges and circumvent system access controls.

The vulnerability exists due to incorrect authorization logic within the Chromoting component. A local attacker with low-level privileges can execute a local program to bypass system access restrictions and gain unauthorized access to sensitive system functions.

This vulnerability poses a significant risk to organizational endpoints by enabling privilege escalation on compromised systems. A successful exploit allows an attacker to achieve high confidentiality and integrity impacts locally, potentially leading to full system compromise. While the CVSS score of 7.1 reflects a high-risk rating, the requirement for local access necessitates that security teams prioritize this for all Windows-based workstations.

Immediate Action: Update Google Chrome to version 152.0.7977.65 or later across all Windows environments.

Proactive Monitoring: Review system logs for unauthorized execution of local processes or unusual activity originating from the Chromoting service.

Compensating Controls: Enforce the principle of least privilege for local user accounts to minimize the potential impact of local escalation attempts.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for privilege escalation, administrators should treat this update with high priority. Ensure all Google Chrome instances are patched to version 152.0.7977.65 or newer to remediate the authorization flaw and prevent local attackers from bypassing system security controls.