The vulnerability is an insufficient validation of untrusted input in the Chrome Updater on Windows. A local attacker can supply a malicious file that is processed by the updater, causing the operating system to execute code with elevated privileges. The flaw is a classic input‑validation weakness and is catalogued as CWE‑20. As a result, once the malicious file is ingested by the updater, the attacker may gain OS‑level privileges and compromise the integrity and confidentiality of the affected system.

Google Chrome running on Windows, any version prior to 148.0.7778.96. Users with the older releases are susceptible to this local privilege‑escalation flaw.

The flaw has a Chromium-reported severity of Medium. The CVSS score is 7.8. No EPSS score is available, indicating an unknown likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no current widespread active exploitation. The attack requires local access with the ability to place a file that the Chrome Updater will process. Because of the potential for privilege escalation, the risk to systems with unauthenticated local attackers is high, and remediation is recommended.