CVE-2019-17190

CVE-2019-17190 describes a local privilege escalation vulnerability in Avast Secure Browser version 76.0.1659.101. The flaw stems from insecure access control list (ACL) settings applied by the AvastBrowserUpdate.exe process, which runs with SYSTEM privileges. When an update check is triggered, this process misconfigures the ACL of the Update.ini file, allowing any low-privileged user to manipulate it. An attacker can exploit this by creating a hard link to a SYSTEM-writable file, gaining elevated privileges. This vulnerability has a CVSS score of 7.8 (High), indicating a low attack complexity and high impact on confidentiality, integrity, and availability. There is no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.