Inappropriate implementation in UI in Google Chrome on Windows prior to 149

CVE-2026-10942 is a Windows-only local privilege escalation flaw in Chrome's UI implementation affecting versions prior to 149.0.7827.53. The vendor description and CVSS vector say the attacker needs local access and user interaction, so this is not a drive-by web bug and not an internet-facing server problem; it is a client-side escalation step after the attacker already has code execution or equivalent local reach on the endpoint.

Google's HIGH 7.8 score is defensible in a vacuum because successful exploitation can hit C/H, I/H, A/H. In real enterprise triage, though, the chain has real friction: AV:L means post-initial-access, UI:R means an extra trigger, the issue is Windows-specific, and there is no KEV listing, no public exploitation evidence, and essentially no EPSS signal in the supplied intel. That pushes this down to a patch-it-in-normal-client cadence MEDIUM, not an out-of-band emergency.

Why this verdict

• Start at vendor 7.8: the raw technical impact is high if exploitation succeeds, so Google did not overstate the damage potential
• Downgrade for attacker position: AV:L means the attacker already has a foothold on the endpoint or equivalent local reach, which is compounding downward pressure for enterprise prioritization
• Downgrade again for reachability: UI:R plus Windows-only scope narrows the exposed population and makes mass exploitation less practical than a normal remote Chrome RCE
• Keep it at MEDIUM, not LOW: Chrome is ubiquitous on enterprise desktops, and a reliable local privesc can materially strengthen malware or hands-on-keyboard operations once an endpoint is compromised

Why not higher?

There is no evidence here of unauthenticated remote exploitation, internet-scale reachability, KEV inclusion, or active campaigns. This bug does not create initial access by itself; it improves the attacker's position only after they already land on a Windows host and trigger the right UI path.

Why not lower?

Privilege escalation on a heavily deployed browser still matters because it can turn a contained user-context intrusion into a more durable endpoint compromise. Even with low EPSS and no public exploitation signal, the impact on a successfully targeted host is too meaningful to relegate to backlog-only hygiene.

1. Enforce Chrome auto-update — Make sure managed Windows endpoints stay on the Stable channel and are not pinned behind stale policies or broken updaters. For a MEDIUM verdict there is no mitigation SLA, so this is an operational hardening step while you drive patch completion inside the 365-day remediation window.
2. Hunt for outdated Chrome on Windows — Query EDR, SCCM/Intune, or software inventory for Chrome versions below 149.0.7827.53 and isolate exceptions like kiosks, VDI gold images, and devices with disabled auto-update. There is no mitigation SLA for MEDIUM; use this to shrink residual exposure while completing remediation within 365 days.
3. Tighten endpoint execution controls — Because the bug is local, AppLocker/WDAC, SmartScreen, attack surface reduction, and EDR prevention directly raise the bar by blocking the attacker from landing or running the prerequisite local stager. For this verdict there is no mitigation SLA; treat it as defense-in-depth while you remediate in the 365-day window.
4. Watch for Chrome privilege anomalies — Tune detections for Chrome spawning unusual high-integrity children, tamper attempts against security tools, suspicious UI automation, and privilege-transition events. Again, no mitigation SLA applies at MEDIUM, but detection reduces dwell time while patch coverage converges inside the 365-day remediation period.

Run this on the target Windows endpoint or through your RMM/EDR live response shell. Example: powershell.exe -ExecutionPolicy Bypass -File .\Test-Chrome-CVE-2026-10942.ps1 — no admin rights required as long as the script can read Chrome install paths and file version metadata.

# Test-Chrome-CVE-2026-10942.ps1

# Checks whether Google Chrome on Windows is vulnerable to CVE-2026-10942

# Vulnerable if installed version is less than 149.0.7827.53

# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromePaths {
    $paths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $p = (Get-ItemProperty -Path $rp).'(default)'
        if ($p) { $paths += $p }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

$chromePaths = Get-ChromePaths
if (-not $chromePaths -or $chromePaths.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome not found on this host'
    exit 2
}

$results = @()
foreach ($path in $chromePaths) {
    try {
        $item = Get-Item $path
        $verString = $item.VersionInfo.ProductVersion
        if (-not $verString) { $verString = $item.VersionInfo.FileVersion }

        # Normalize versions like 149.0.7827.53 (Official Build) to numeric prefix only

        if ($verString -match '(\d+\.\d+\.\d+\.\d+)') {
            $ver = [version]$matches[1]
            $state = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
            $results += [pscustomobject]@{
                Path    = $path
                Version = $ver.ToString()
                State   = $state
            }
        }
    }
    catch {
        # Ignore individual path errors and continue

    }
}

if (-not $results -or $results.Count -eq 0) {
    Write-Output 'UNKNOWN - Could not determine Chrome version'
    exit 2
}

$results | ForEach-Object {
    Write-Output ("{0} - {1} - {2}" -f $_.State, $_.Version, $_.Path)
}

if ($results.State -contains 'VULNERABLE') {
    exit 1
}
else {
    exit 0
}

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases blog
3. Chrome Enterprise previous release notes
4. Chrome browser release channels
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Canadian Centre for Cyber Security advisory AV26-544