CVE-2026-13800: Chrome Windows Updater Privilege Escalation – Patch Version 150.0.7871.47

Technical summary

CVE-2026-13800 stems from an improper implementation of privilege-handling logic within Chrome's Updater component on Windows. The vulnerability is classified under CWE-284 (Improper Access Control) and permits unauthenticated local privilege escalation when a user interacts with a specially crafted file. The attack vector is local (AV:L), requires no special privileges to execute (PR:N), involves user interaction (UI:R), and compromises confidentiality, integrity, and availability at the system level (C:H/I:H/A:H). The CVSS v3.1 base score of 7.8 (HIGH) reflects the severity of unrestricted system-level access following successful exploitation.

Business impact

Successful exploitation enables attackers with local access to escalate privileges to system or administrator level, potentially leading to complete system takeover, data exfiltration, malware installation, and lateral movement within corporate networks. For organizations with Chrome as a standardized browser, this vulnerability expands the threat model beyond remote web-based attacks to include local privilege escalation paths. In shared or multi-user environments (helpdesks, labs, kiosks), the risk is amplified.

Affected systems

Google Chrome on Microsoft Windows systems running version 149 and earlier are affected. The vulnerability is resolved in Chrome 150.0.7871.47 and later. Organizations should verify their Chrome deployment versions; enterprise deployments using Google Chrome Enterprise or Chromium-based browser variants should confirm whether their specific builds and versions address this issue.

Exploitability

Exploitation requires local system access and user interaction—specifically, the user must open or interact with a malicious file crafted by the attacker. While this limits opportunistic mass exploitation, it remains a practical threat in scenarios involving social engineering, insider threats, or compromise of removable media. The ease of construction (given only local access and user action) is moderate; however, the lack of KEV listing as of the source data date suggests limited evidence of active exploitation in the wild at publication time.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later on all Windows systems. For Windows enterprises, use Google Update for Work or similar centralized deployment mechanisms to enforce timely patching. Verify update deployment and confirm that no systems remain on vulnerable versions. Consider supplementary controls: restrict file type associations, enforce application whitelisting, and educate users against opening untrusted files.

Patch guidance

Patch availability: Google Chrome 150.0.7871.47 and later. Deployment method depends on your Chrome deployment model: standalone installations receive updates through Chrome's auto-update mechanism (verify in chrome://settings/help), while enterprise deployments should use Google Update for Work, Group Policy (for Chromium variants in enterprise), or mobile device management (MDM) solutions. Test patches in non-production environments to confirm compatibility before broad rollout. Verify patching completion using browser version checking (chrome://version or chrome://about) across your fleet.

Detection guidance

Monitor for Chrome version discrepancies across your endpoint fleet using your EDR, MDM, or software inventory tools; flag instances running versions prior to 150.0.7871.47. Examine Windows event logs for suspicious updater-related processes (e.g., chrome.exe with unusual parent processes or elevated privilege tokens) that deviate from normal update behavior. Behavioral detection should flag attempts to write malicious files to Chrome updater directories or temporary paths typically used during exploitation. File integrity monitoring on Chrome application directories may reveal unauthorized modifications preceding an escalation attempt.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (7.8), which reflects direct achievement of system-level privilege escalation. While KEV inclusion is currently absent, the practical exploitability (requiring only local access and basic user interaction) and the ubiquity of Chrome in modern environments make it a realistic attack vector. Organizations with shared Windows systems, help desk environments, or security-sensitive data should treat this as critical. Prioritize systems where Chrome users have administrative aspirations or where local privilege escalation could facilitate lateral movement.

Risk score, explained

The CVSS v3.1 base score of 7.8 (HIGH) reflects: (1) local attack vector, (2) low attack complexity, (3) no privilege requirement, (4) required user interaction, and (5) high impact on confidentiality, integrity, and availability. The score appropriately captures the severity of unrestricted system-level access. Organizations may adjust severity based on environmental factors: enterprises with strict application controls and limited local file handling may lower severity, while organizations with shared systems or elevated Chrome exposure should consider this a critical issue.

Frequently asked questions