An insufficient input validation flaw in the Google Chrome Updater component on Mac allows local attackers to achieve operating system level privilege escalation through a malicious file.

This is an insufficient validation of untrusted input vulnerability categorized under CWE-20, triggered locally via a malicious file with required user interaction.

A successful exploit allows a local user to compromise the underlying operating system by escalating privileges to total control levels. This introduces severe risks of unauthorized data access, system manipulation, and potential malware persistence on affected workstations. The assigned CVSS score of 7.8 reflects the high technical severity and impact despite the local attack vector requirement.

Immediate Action: Update Google Chrome on Mac to version 148.0.7778.96 or later as provided by the vendor security advisory.

Proactive Monitoring: Monitor endpoint detection tools for anomalous local process executions originating from the Google Chrome updater context.

Compensating Controls: Ensure strict user permission controls on workstations to minimize the risk of untrusted local file execution by standard users.

Public Exploit Available: No

Security teams must prioritize updating Google Chrome instances across all Mac endpoints to version 148.0.7778.96 or higher. Prompt deployment of this update eliminates the underlying input validation vector and secures the local environment against privilege escalation attempts.