Inappropriate implementation in Installer in Google Chrome on Windows prior to 149

CVE-2026-11103 is a Windows-only Google Chrome Installer flaw affecting versions prior to 149.0.7827.53. The bug lets a local attacker use a malicious file to cross an OS privilege boundary, so the end state is meaningful: code that started at normal user level may end up with elevated rights on the host.

The vendor-style HIGH/7.3 label overstates patch urgency for enterprise triage because the attacker does not get in from the network. They need a local foothold, a logged-in user context, and user interaction with a malicious file first. That makes this a post-initial-access privilege-escalation assist, not an internet-exposed emergency, so the operational severity drops to MEDIUM even though the technical impact is serious when it lands.

Why this verdict

• Down from 7.3 because attacker position is already inside the host — AV:L + PR:L means the adversary needs local execution or a valid user context first, which implies prior compromise or insider access
• Another notch down because user interaction is required — UI:R plus a malicious file means this is not a silent drive-by or wormable browser bug
• Narrower reachable population than generic Chrome RCE — Windows-only installer path, not Linux/macOS/Android, and only endpoints still below 149.0.7827.53 are in play
• Threat intel is cold — no KEV listing, no public exploitation evidence surfaced here, no confirmed public PoC, and EPSS is extremely low
• But not low/ignore — Chrome is ubiquitous, and local privesc on a browser-heavy Windows fleet still meaningfully amplifies commodity malware once it gets a foothold

Why not higher?

This is not remotely reachable and does not give an attacker a beachhead by itself. Modern enterprise controls should block many chains before the malicious file ever reaches a vulnerable installer path, and even after initial access the exploit still has to work reliably on the endpoint.

Why not lower?

Privilege escalation still matters because it converts cheap user-level access into something with much higher host impact. On a large Windows estate, even a medium-confidence local privesc in a ubiquitous product can materially improve attacker survivability and follow-on abuse once another entry vector succeeds.

1. Block execution from user-writable paths — Use WDAC, AppLocker, or SRP to prevent executables, scripts, and MSI-like launch paths from Downloads, %TEMP%, %APPDATA%, and other user-writable locations. This directly attacks the malicious-file prerequisite and is worth doing now; for a MEDIUM finding there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but this hardening should still be standard baseline hygiene.
2. Keep Chrome auto-update enabled — Review Chrome Enterprise update policy and remove version pins or disabled-update settings that strand devices below 149.0.7827.53. Google recommends automatic updates; for this MEDIUM verdict there is no mitigation SLA, so use normal change control while making sure the estate naturally converges on the fixed build well inside the remediation window.
3. Alert on abnormal Chrome installer activity — Create EDR detections for Chrome or Google Update installer components spawning shells, script hosts, LOLBINs, or writing into protected locations. This does not replace patching, but it raises the cost of using the bug for local privesc while vulnerable versions still exist.
4. Reduce standing local admin and installer abuse paths — Enforce least privilege, tighten software installation rights, and review installer-related allow rules that give normal users too much leverage. That limits the blast radius if an attacker tries to turn a user-context foothold into elevated execution through any local installer bug, not just this one.

Run this on the target Windows endpoint or through your RMM/EDR live response console. Invoke it with powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11103.ps1; standard user rights are usually enough to read file versions, but admin rights help if you want complete visibility into all install locations. The script reports VULNERABLE, PATCHED, or UNKNOWN based on installed Chrome version compared with the fixed build 149.0.7827.53.

#requires -version 5.1
<#
check-chrome-cve-2026-11103.ps1
Purpose: Detect likely exposure to CVE-2026-11103 by checking installed Google Chrome
         versions on Windows against fixed version 149.0.7827.53.
Output : VULNERABLE / PATCHED / UNKNOWN
Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$FixedVersion = [version]'149.0.7827.53'
$Found = @()

function Get-VersionObject {
    param([string]$VersionString)
    if ([string]::IsNullOrWhiteSpace($VersionString)) { return $null }
    $clean = ($VersionString -replace '[^0-9\.]', '').Trim('.')
    try { return [version]$clean } catch { return $null }
}

function Add-Candidate {
    param([string]$Path)
    if (-not [string]::IsNullOrWhiteSpace($Path) -and (Test-Path $Path)) {
        $item = Get-Item $Path
        $ver  = Get-VersionObject $item.VersionInfo.ProductVersion
        if (-not $ver) { $ver = Get-VersionObject $item.VersionInfo.FileVersion }
        if ($ver) {
            $Found += [pscustomobject]@{
                Path    = $Path
                Version = $ver
            }
        }
    }
}

# Common install locations
$Candidates = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

foreach ($c in $Candidates) { Add-Candidate -Path $c }

# App Paths registry
$appPathKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)
foreach ($key in $appPathKeys) {
    $defaultPath = (Get-ItemProperty -Path $key).'(default)'
    if (-not $defaultPath) { $defaultPath = (Get-Item -Path $key).GetValue('') }
    Add-Candidate -Path $defaultPath
}

# Deduplicate by path
$Found = $Found | Sort-Object Path -Unique

if (-not $Found -or $Found.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome not found in standard locations'
    exit 2
}

$Vulnerable = $Found | Where-Object { $_.Version -lt $FixedVersion }

if ($Vulnerable) {
    $details = ($Vulnerable | ForEach-Object { "$($_.Path) [$($_.Version)]" }) -join '; '
    Write-Output "VULNERABLE - Found Chrome version(s) below $FixedVersion : $details"
    exit 1
}
else {
    $details = ($Found | ForEach-Object { "$($_.Path) [$($_.Version)]" }) -join '; '
    Write-Output "PATCHED - All discovered Chrome version(s) are >= $FixedVersion : $details"
    exit 0
}

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Chromium issue reference 500483038
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. Chrome Enterprise - Manage Chrome updates
7. Chrome Enterprise - Manage Chrome updates (Windows)
8. Google Chrome Help - Update Google Chrome