CVE-2024-1694 is a high severity (CVSS 7.8) flaw in the Google Updater used by Chrome, in versions before 1.3.36.351. A local attacker could bypass discretionary access control with a malicious file. Chromium rates it High, and the fix is to let the updater and Chrome update.
What's affected
The record says Google Updater prior to 1.3.36.351 in Google Chrome is affected, and lists Microsoft Windows as the platform. The only reference is the Chromium issue 40946325, whose details may be restricted. The record's description says a local attacker could bypass discretionary access control via a malicious file, and rates it High under the Chromium scale. The NVD score is 7.8 (high) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is CWE-474 (use of function with inconsistent implementations).
How to check if you're exposed
On Windows, Google Updater runs as part of Chrome's update system. You can check Chrome's version on the About page.
chrome://version
If Chrome updates itself normally, the updater is kept current too. On managed fleets, ask your endpoint tool for the updater version and compare with 1.3.36.351. Look for machines where updates are blocked by policy or network rules, since they are the ones that lag.
What to do now
- Let Chrome and its updater update, or push the update through your management tool.
- Check machines where update policy blocks automatic updates.
- Limit which users can log in locally on shared or sensitive machines.
- Keep standard users away from administrative rights.
- Verify the updater version in your inventory after the rollout.
Why it matters
Local privilege flaws matter after an attacker already has a foothold. A low privileged user or a piece of malware on a Windows machine can use a bug like this one to gain more control than intended. The updater runs with high privileges so that it can update software for everyone on the machine, which makes it an attractive target.
The record is thin on mechanics because the Chromium issue is not public, so this post does not guess. The KEV flag is false. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Is this remotely exploitable?
No. The record describes a local attacker, so a foothold on the machine is needed first.
Sources
Last reviewed: 19 October 2026.
