CVE-2026-11103: Chrome Installer Privilege Escalation on Windows

Technical summary

CVE-2026-11103 is a privilege escalation vulnerability in the Chrome Installer component affecting Windows systems running Google Chrome prior to version 149.0.7827.53. The root cause is improper implementation in the installer's file handling logic, classified under CWE-269 (Improper Access Control). The vulnerability requires local code execution and user interaction (opening a malicious file) but does not require the attacker to have pre-existing privileges. Once triggered, an unprivileged user can escalate to OS-level administrative rights. The CVSS 3.1 score of 7.8 (HIGH severity) reflects the high confidentiality, integrity, and availability impact across the system, though attack complexity is low and privilege requirements are none.

Business impact

For organizations deploying Chrome across Windows endpoints, this vulnerability creates a lateral movement and persistence risk. An attacker who gains initial access as a low-privileged user—via phishing, malware delivery, or supply chain compromise—could weaponize this flaw to obtain system-level control without interaction from a system administrator. This elevation enables endpoint compromise, credential theft, malware installation, and lateral network movement. Unpatched Windows Chrome installations become high-value targets for both opportunistic and targeted attacks. The impact is particularly acute in environments where Chrome is used alongside sensitive workflows and where endpoint segmentation relies on user-level privilege boundaries.

Affected systems

Google Chrome on Microsoft Windows is the affected product family. Any installation prior to version 149.0.7827.53 is vulnerable. Both standalone Chrome installations and those distributed through enterprise deployment mechanisms are in scope. The vulnerability does not affect Chrome on macOS, Linux, or other operating systems; it is Windows-specific due to the installer implementation differences. Organizations should verify their deployed Chrome versions and Windows patch levels in their asset inventory.

Exploitability

The attack is locally exploitable with low complexity: no special system configuration or unusual user behavior is required beyond the user opening a malicious file. The attacker does not need existing system access—any local user can trigger the vulnerability. However, exploitation does require user interaction (file opening), which slightly reduces real-world exploitability compared to a purely remote, no-interaction attack. Given the prevalence of phishing and social engineering, this friction is often surmountable. The vulnerability has not been designated for inclusion in the CISA KEV catalog as of the last data update, but local privilege escalation flaws of this severity frequently become preferred post-compromise tactics and should be monitored for public exploit availability.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all Windows systems. Chrome typically updates automatically, but in enterprise environments with managed deployments, verify that the latest version has been pushed to endpoints. For organizations using group policy or mobile device management (MDM) to control Chrome updates, confirm that update policies are not blocking the patched version. No configuration workarounds are available; patching is the only mitigation. Uninstall and reinstall Chrome if automatic updates fail.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later across all Windows endpoints. Verify deployment through Chrome's built-in update mechanism (Settings > About > Google Chrome) or your enterprise deployment tool. Test the patched version in a pilot group of endpoints before full rollout to ensure compatibility with critical line-of-business applications that depend on Chrome. For organizations using Chrome Enterprise, confirm that the update has been approved and published in your managed deployment channel. Monitor Chrome version compliance through your endpoint management console to identify and remediate any machines still running vulnerable versions.

Detection guidance

Check running Chrome processes and the 'About Chrome' menu to verify installed version numbers. Look for version strings earlier than 149.0.7827.53. Endpoint Detection and Response (EDR) tools should flag attempts to manipulate installer files, particularly suspicious modifications to Chrome installation directories or use of installer components outside of the normal update flow. Monitor for unusual privilege escalation events following Chrome file interactions. Network-based detection is limited since the attack is purely local; focus on endpoint telemetry. Log analysis should capture process creation events where Chrome processes or installer processes spawn child processes with elevated privileges or access tokens.

Why prioritize this

Although not yet listed on the CISA KEV catalog, this is a local privilege escalation affecting a ubiquitous Windows application with high business impact. The combination of low attack complexity, no privilege requirement, and high confidentiality/integrity/availability impact makes it an attractive post-compromise tactic for attackers. Organizations should prioritize patching based on the criticality of the affected endpoints and the sensitivity of data they can access once compromised. Systems used by administrators, developers, or for sensitive tasks warrant priority patching. The attack surface is broad: any user with file-opening capability can trigger it.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector with no privilege requirement and low complexity, paired with full system impact. While the attack requires user interaction (opening a file), this is a low friction requirement in real-world scenarios given phishing prevalence. The severity is driven by the ability to escalate from user to system level, enabling complete endpoint compromise and lateral movement. The score appropriately characterizes the risk to Windows-based organizations; remediation through patching is straightforward and should be prioritized accordingly.

Frequently asked questions