2

Normally, when an application wants to write to C:\Program Files, a pop up is shown that asks me to confirm to elevate this application into admin mode so that it can write to C:\Program Files.

With Google Chrome this doesn't seem to be the case. I'm not running Chrome with admin privileges but still it seems to be able to automatically update itself and write to C:\Program Files without asking me for confirmation first.

How does this work? All other applications seem to need explicit confirmation before they are able to write to C:\Program Files but Google Chrome doesn't. It can just write to C:\Program Files even though I'm not running it with admin permissions.

4
  • 3
    It installs a Update service with system privileges.
    – eckes
    Mar 19, 2017 at 11:45
  • I'm not sure, but it might: a. Sign itself so that it can execute code or b. Have another elevated service that does the work.
    – thel3l
    Mar 19, 2017 at 11:46
  • Thanks for the information. I'd prefer to have an extra warning/confirmation dialog if an application tries to install a service with system privileges but it seems like every app can just do that during installation and I don't need to specifically approve it... not very nice :(
    – Andreas
    Mar 19, 2017 at 17:23
  • 1
    @eckes: your comment should be an answer
    – Lie Ryan
    Mar 20, 2017 at 3:44

1 Answer 1

1

The initial install requires per UAC prompt admin rights. It then uses this to install an update service. This one uses a local system account which has enough permissions.

Some other software uses btw the Windows scheduler. Funny enough it is quite easy to have such a high privileged background job, it's much more complicated to do that transparently as the user with admin rights.

1
  • Funny thing: when Chrome was first introduced, I recall reading about how unlike other browsers, it didn't need admin rights to install, and that that was in fact a security benefit - by having a fully non-elevated installation process, it guaranteed the browser could never gain access to anything protected by elevation, effectively making it more sandboxed than the competition. Clearly, they changed that, as it does install with admin rights now, but an interesting bit of trivia. Mar 29, 2021 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.