CVE-2026-14094: Chrome Windows Installer Use-After-Free Privilege Escalation

Technical summary

CVE-2026-14094 is a use-after-free vulnerability (CWE-416) in the Chrome installer component affecting Windows systems. The vulnerability allows a local, unauthenticated attacker to trigger a privilege escalation by crafting a malicious file that induces the installer to reference freed memory. The attack requires user interaction and does not involve network access. Chrome versions prior to 150.0.7871.47 are vulnerable. While Google's internal severity assessment was 'Low,' the CVSS v3.1 score reflects the high impact potential: complete confidentiality, integrity, and availability compromise on the local system.

Business impact

Successful exploitation grants an attacker OS-level privilege escalation on affected Windows machines, effectively compromising system integrity and data confidentiality. Organizations with users who install or update Chrome from local media, removable drives, or shared network locations face elevated risk. Compromised systems can be leveraged for lateral movement, data theft, ransomware deployment, or persistence mechanisms. The impact is significant for enterprises with strict access controls that assume installer authenticity.

Affected systems

The vulnerability affects Google Chrome running on Microsoft Windows platforms prior to version 150.0.7871.47. This includes both consumer and enterprise deployments. The attack vector is local, so exposure is limited to systems where an attacker can supply a malicious file to the target user. Enterprises using managed Chrome deployments or auto-update mechanisms may have reduced exposure if update policies enforce the patched version promptly.

Exploitability

Exploitation requires local file access and user interaction—specifically, the user must open or process a malicious file in a context that triggers the installer's vulnerable code path. While the technical barrier is moderate (use-after-free bugs can be unpredictable to trigger reliably), the local-only nature and need for user action limit mass exploitation scenarios. No active exploit code is known to be in the wild as of the publication date. The attack is not remotely exploitable.

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all affected Windows systems. Organizations should prioritize patching for users with administrative privileges or those who regularly install or update applications. Verify the patch is applied through Chrome's About page (chrome://about) or enterprise policy reports. No workarounds mitigate the vulnerability; patching is the only remediation.

Patch guidance

Deploy Chrome 150.0.7871.47 or newer across your Windows fleet via auto-update, managed deployment (MSI/Group Policy), or manual user notification. For enterprise environments, use Google Update or third-party patch management tools to automate deployment. Confirm patch application within 72 hours; monitor update logs to identify any systems lagging behind the required version. Test the patch in a non-production environment first if you maintain a staged rollout policy.

Detection guidance

Monitor for failed or suspicious Chrome installer processes, especially those initiated by unprivileged users. Log and alert on unusual file access patterns from installer components. Endpoint Detection and Response (EDR) tools should flag crashes or unexpected privilege elevation attempts from Chrome-related binaries. Check deployed Chrome version against 150.0.7871.47 using asset inventory or Chrome synchronization reports. File integrity monitoring on installer directories can detect tampering attempts.

Why prioritize this

Although the vulnerability requires local access and user interaction, the consequence—OS-level privilege escalation with full system compromise—is severe. Organizations should treat this as a medium-to-high priority patch due to the confidentiality, integrity, and availability impact. Prioritize systems where users have administrative responsibilities or access sensitive data. The lack of network-based exploitation reduces urgency slightly compared to remote code execution vulnerabilities, but the privilege escalation outcome justifies rapid deployment.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) reflects the combination of local attack vector (reduces likelihood), no privileges required, user interaction required (reduces immediate risk), but with severe impact across all three axes: confidentiality, integrity, and availability. The score appropriately captures that while exploitation barriers exist, a successful attack results in near-complete system compromise. The disparity with Google's internal 'Low' severity likely reflects their confidence in auto-update deployment and the practical difficulty of triggering the use-after-free reliably.

Frequently asked questions