CVE-2023-7261: 
NixOS vulnerability analysis and mitigation

CVE-2023-7261 is a high-severity vulnerability discovered in Google Chrome's Updater component. The vulnerability affects Google Updator versions prior to 1.3.36.351 and was disclosed on June 7, 2024. This security flaw allows local attackers to perform privilege escalation through a malicious file (NVD).

The vulnerability stems from an inappropriate implementation in the Google Updator component. It has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically involves the update mechanism where an attacker can abuse it to launch an executable from an untrusted location (ZDI).

When successfully exploited, this vulnerability allows an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability (ZDI).

The vulnerability requires local access to the system and user interaction. An attacker must have the ability to execute low-privileged code on the target system to exploit this vulnerability. The specific flaw exists within the update mechanism, where an attacker can abuse the update process to launch malicious executables (ZDI).

The vulnerability has been patched in Google Updator version 1.3.36.351. Users and administrators are advised to update to this version or later to mitigate the risk (NVD).