CVE-2023-7261 is an inappropriate implementation in Google Updater, the component that updates Chrome, before version 1.3.36.351. A local attacker could escalate privileges using a malicious file. It scores 7.8 (High), and Chromium rates it High. Updater version 1.3.36.351 contains the fix, so confirm managed machines have it.
What's affected
Affected: Google Updater prior to 1.3.36.351, which the record ties to Google Chrome. Fixed: 1.3.36.351 and later.
The record's description includes Chromium's own rating: the Chromium security severity is High. The NVD score is 7.8, also High. The vector is local, low complexity, no privileges, but user interaction is required. The weakness is CWE-233, improper handling of parameters. KEV is false. I could not load the Chromium issue page (40064602), so the cause is described only at the level of the record.
This is a flaw in the updater, not in the browser engine. Chrome itself being current does not prove the updater is current, though in normal installs the updater keeps itself current.
How to check if you're exposed
Most Chrome installs update the updater without anyone noticing, so the question is mostly about machines where updates are blocked or delayed. Check with your endpoint management tool for the Google Updater version, or look at the version folder inside the updater's installation directory on the machine.
On machines where users do not have rights to update software, or where Chrome is pinned to an old version by policy, look first. Offline images and lab machines are the usual stragglers.
What to do now
- Let Chrome and its updater update normally. Check that policy or network rules are not blocking Google's update servers.
- Use your inventory to find machines that report an updater version older than 1.3.36.351.
- Rebuild or refresh stale golden images so new machines do not start on old components.
- Limit local accounts on shared machines. This bug needs local access.
Why it matters
Updaters are an attractive target because they run with high privileges so they can install software for everyone on the machine. If an updater handles a file or a parameter in a way an attacker can influence, a low privilege user may make it act with the higher rights.
This is a local attack, so it matters most on shared machines, kiosks, VDI hosts and anywhere an attacker could land as a standard user. On a single user laptop with no other local accounts, the practical risk is lower.
The broader lesson is to inventory helper components, not just the main applications. Updaters, agents and drivers are software too.
Quick check
Is Chrome itself vulnerable in CVE-2023-7261?
The flaw is in Google Updater, the component that updates Chrome. The record lists Chrome as an affected product.
What version fixes it?
Google Updater 1.3.36.351, per the record.
Sources
Last reviewed: 19 October 2026.
