A race condition in the Chrome updater on macOS allows a local attacker to place a malicious file that the updater will process, leading to OS-level privilege escalation. The vulnerability is considered critical within Chromium, with a CVSS score of 7.8 and a very low EPSS rate (<1 %). No remote exploitation is described, and the case does not yet appear in CISA’s KEV catalog.

Google Chrome installed on macOS versions older than 151.0.7922.72 is affected. Users running the stable channel version 151.0.7922.72 or later have the fix applied.

The exploit requires local access and the ability to spawn a malicious file in a directory that Chrome’s updater will read. Because the EPSS indicates a low probability of exploitation and the attack path is local, the immediate risk is limited to environments where the updater is writable by a user with local privileges. The CVSS score reflects high impact if exploited, although the lack of remote access and current absence from KEV suggest a lower overall threat compared to high‑impact network‑exposed flaws.