CVE-2026-110150 in Chrome
Summary
by MITRE • 10/13/2026
Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CVE-2024-6338 represents a critical privilege escalation flaw within the Google Chrome installer component on Microsoft Windows operating systems prior to version 155.0.8059.79. This security defect is classified with high severity by the Chromium project and fundamentally undermines the integrity of the installation process, which typically requires elevated administrative privileges. The core issue stems from improper handling of file permissions or path validation during the execution of installer scripts, allowing a local attacker to manipulate the environment in which the installer operates. By exploiting this flaw, an adversary running with lower privileges can influence the actions taken by the high-privilege installation process, effectively bypassing standard access controls that are designed to prevent unauthorized modifications to system files or configurations.
From a technical perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Management and potentially CWE-732 Incorrect Permission Assignment for Critical Resource if specific file paths were involved in the exploitation chain. The attacker leverages local program execution capabilities to trigger conditions where the installer fails to verify that resources are being accessed from trusted locations or by authorized entities. This lack of rigorous validation allows the injection of malicious payloads or the redirection of sensitive data flows. In many such scenarios, the vulnerability may also relate to CWE-20 Improper Input Validation if user-controlled input is not sanitized before being used in file system operations during installation. The exploitation does not require remote access; it relies entirely on local presence and the ability to execute arbitrary code or scripts within the context of a standard user account.
The operational impact of this vulnerability extends beyond simple privilege escalation, as noted in the original description which highlights the potential for obtaining sensitive information. While privilege elevation is the primary mechanism, the consequence includes unauthorized access to confidential data stored on the local machine. An attacker could potentially exfiltrate credentials, browser history, saved passwords, or other personally identifiable information that Chrome stores locally. This compromises user privacy and organizational security if deployed in enterprise environments where shared workstations are common. The ability to read sensitive files via a privilege escalation vector means that even users with limited administrative rights can compromise the entire system's confidentiality posture.
This behavior is consistent with ATT&CK technique T1055 Process Injection or more accurately T1068 Exploitation for Privilege Escalation, as it involves leveraging software vulnerabilities to gain higher-level access. Additionally, if the attacker modifies installer files to persist their presence, techniques such as T1547 Boot or Logon Autostart Execution might be relevant in subsequent stages of an attack chain. The vulnerability highlights a significant gap in how third-party installers handle security boundaries on Windows platforms, particularly when dealing with temporary directories or environment variables that can be manipulated by lower-privileged processes.
Mitigation strategies primarily involve immediate patching to version 155.0.8059.79 or later, which addresses the underlying logic errors in the installer component. Organizations should enforce strict application control policies using tools like Windows Defender Application Control or AppLocker to prevent unauthorized executables from running during installation processes. Furthermore, implementing least-privilege principles ensures that even if an attacker gains local access, their ability to interact with high-privilege components is restricted. Regular auditing of installer logs and monitoring for unusual file system activity around the Chrome installation directory can also aid in early detection of exploitation attempts. Security teams should prioritize updating all endpoints running affected versions to eliminate this attack vector entirely.