A race condition in Google Chrome’s Windows updater allows a local user to influence the timing of temporary file creation. By supplying a malicious file that the updater will later process, an attacker can achieve a local privilege escalation with the privileges of the Chrome process and potentially gain elevated rights on the system.

All Windows installations of Google Chrome older than version 151.0.7922.72 are affected, as the issue resides in the updater component present in those releases.

The CVSS score of 7 indicates a moderate to high potential impact, while the EPSS score of less than 1% shows that exploitation at present is considered rare. The vulnerability is not listed in CISA’s KEV catalog and requires a local attacker who can place a file in a location the updater will attempt to process. No remote exploitation vector is documented, limiting the threat to accounts that have local or remote‑accessed local privileges.