CVE-2026-14018: Chrome Updater Use-After-Free Privilege Escalation on Windows

Technical summary

CVE-2026-14018 is a use-after-free vulnerability (CWE-416) in the Updater component of Google Chrome versions prior to 150.0.7871.47 on Windows. The flaw allows a local attacker to achieve OS-level privilege escalation by providing a malicious file that triggers memory mismanagement in the Updater process. The vulnerability has a CVSS v3.1 score of 7.8 (HIGH) with a Local Attack Vector, Low Attack Complexity, and no privilege requirement. User interaction is required. The vulnerability results in high impact to confidentiality, integrity, and availability (C:H, I:H, A:H).

Business impact

This vulnerability poses a significant risk to Windows-based organizations relying on Chrome as a primary browser or development tool. A successful exploit grants an attacker full system access, enabling lateral movement, data theft, malware installation, and potential lateral spread to other systems on the network. For enterprises with user-facing Chrome deployments or developers using Chrome, timely patching is critical to prevent privilege escalation attacks that bypass standard security controls. The attack vector (local with user interaction) means it could be delivered through email attachments, cloud storage files, or deceptive downloads.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on Windows are affected. The vulnerability is local and requires an attacker to have file system or file delivery capability on the target machine. Any Windows system running a vulnerable version of Chrome is at risk. The attack surface includes all users with Chrome installed, regardless of account privilege level, since the exploit elevates privileges as part of the attack.

Exploitability

The vulnerability is practical to exploit for a local attacker. It requires delivery of a malicious file and user interaction (e.g., opening or processing the file), but does not require prior system access, special network conditions, or target-specific knowledge. The low attack complexity and absence of privilege requirements mean a standard user can trigger the flaw. However, the exploit is not trivially deployed remotely; an attacker must place a malicious file where the target will interact with it. This lowers the risk compared to remote exploits but still represents a meaningful threat in targeted attacks, supply-chain scenarios, or mass phishing campaigns.

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all Windows systems. Ensure automatic updates are enabled in Chrome to receive future security patches promptly. For managed environments, use Group Policy (Windows) or other enterprise management tools to enforce Chrome version policies and disable downgrade paths. Additionally, educate users to avoid opening unexpected files, especially from untrusted sources, and configure download scanning policies to flag suspicious file types.

Patch guidance

Deploy Chrome version 150.0.7871.47 or newer across your environment. Chrome's auto-update mechanism typically rolls out patches within hours to days of release; verify deployment via Chrome's Settings > About Chrome, which displays the current version and update status. For organizations with auto-update disabled, manually update via official Google repositories or Windows Package Manager. Test the patched version in a non-production environment if your organization applies a staged rollout policy. Confirm that Updater components are included in the update (they are by default).

Detection guidance

Monitor for signs of exploitation, including unexpected privilege escalation from Chrome or Updater processes, file creation in system-critical directories by Chrome sub-processes, and sudden elevated access from user accounts. Use endpoint detection and response (EDR) tools to flag anomalous behavior from chrome.exe or GoogleChromeUpdater.exe, particularly calls to OS-level privilege escalation APIs. Hunt for evidence of malicious files delivered through email, cloud storage, or messaging platforms that correlate with Chrome process anomalies. Process memory dumps of crashed or suspicious Updater processes may contain exploitation artifacts.

Why prioritize this

This vulnerability merits immediate priority despite the KEV list not including it. The combination of high CVSS (7.8), complete system compromise potential, and Windows-wide prevalence creates substantial risk. The local-only attack vector and user-interaction requirement make it less critical than remote exploits, but insider threats, targeted spear-phishing, and supply-chain delivery methods remain viable. Organizations with high Chrome usage density or users handling sensitive data should prioritize patching within 24–48 hours.

Risk score, explained

The CVSS score of 7.8 reflects the severity of a successful exploit (full system privilege escalation with impact to confidentiality, integrity, and availability) balanced against the requirement for local access and user interaction. The score does not diminish the real-world threat; many organizations face realistic scenarios where files are exchanged and users interact with content. The absence of a network attack vector prevents a Critical (9.0+) score, but the outcome of exploitation—complete system compromise—justifies the HIGH severity band.

Frequently asked questions