CVE-2026-11103: Inappropriate implementation in Installer in Google Chrome on Windows prior to 149

Synopsis

A local privilege escalation vulnerability exists in the installer component of Google Chrome on Windows in versions prior to 149.0.7827.53. An attacker who already has a low-privilege account on the host can place a malicious file to manipulate the installer's behavior, triggering a flaw that elevates their OS-level privileges. Successful exploitation gives the attacker high-level access to confidentiality, integrity, and availability of the system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are needed to initiate the attack.

• Victim interactionRequired

  A user on the target system must take an action, such as running or interacting with the installer, for the malicious file to trigger the privilege escalation.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to succeed.

Blast Radius

• The attacker gains full read access to sensitive files and data on the host system, including credentials and application secrets.
• The attacker can write or modify files and system configuration at the OS level, including replacing binaries or altering security settings.
• The attacker can crash or disable system services, including security tooling, leading to a full loss of availability for affected processes.
• Combined control over confidentiality, integrity, and availability means the host can be used as a foothold for further lateral movement within the environment.