An insufficient input validation vulnerability in the Google Chrome Updater for Windows allows a local attacker to achieve operating system level privilege escalation.

This is an insufficient validation of untrusted input flaw, classified under CWE-20, affecting the updater mechanism and requiring local access with user interaction.

A successful exploit of this vulnerability could allow a local threat actor to escalate privileges to the operating system level, potentially leading to complete system compromise, data theft, or malware installation on vulnerable workstations. While the CVSS score is 7.8, the ability to achieve total technical impact makes this a high priority concern for endpoint security.

Immediate Action: Update Google Chrome on Windows to version 148.0.7778.96 or later.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution originating from the Google Chrome Updater directory.

Compensating Controls: Restrict local user permissions where possible to limit the damage an escalating local attacker can achieve.

Public Exploit Available: false

Organizations should prioritize updating all Google Chrome installations on Windows endpoints to version 148 or later. Applying this update immediately mitigates the privilege escalation risk posed by inadequate input validation within the updater component.