CVE-2026-17993 Race condition in Chrome

High 7.0 Published 30 Jul 2026 Updated 31 Jul 2026

A local attacker can escalate privileges via a race condition in the Chrome Updater on Windows using a malicious file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-17993?

CVE-2026-17993 is a high-severity vulnerability in Google Chrome, published on 30 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

Weakness: CWE-362

Which versions are affected by CVE-2026-17993?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2026-17993?

Upgrade to a fixed version.

Is CVE-2026-17993 being exploited?

There is no known exploitation of CVE-2026-17993 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-17993, ECHO-c059-0911-47b8, GHSA-8854-j33c-jpcf, MINI-v9q6-mp4c-8chj.