Chromium

UserAgent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36

Steps to reproduce the problem:
1. Make sure there's a Program.exe at C:\(if the chrome is installed at C:\Program Files\Google)
2. Wait(If) chrome shell GoogleCrashHandler.exe.The"Program.exe"will run and get System Privileges instead of"GoogleCrashHandler.exe"

What is the expected behavior?
"Program.exe"get a System Privilege

What went wrong?
Chrome has such a problem which will cause a Path Privilege Escalation Vulnerability.
After installing the Google Chrome(zh-CN version),the chrome will shell"GoogleCrashHandler.exe"
I can see the command line is "C:\Program Files\Google\Updata\1.3.21.115\GoogleCrashHandler.exe"in Process Explorer
Then Chrome will give "GoogleCrashHandler.exe"a System Privilege.
Maybe Chrome uses the CreateProcess function at here,but it isn't used in a correct way.So if there is a Program.exe at C:\,when Chrome run
"GoogleCrashHandler.exe".The system tries to interpret the possibilities in the following order:
c:\program.exe files\sub dir\program name
c:\program files\sub.exe dir\program name
c:\program files\sub dir\program.exe name
c:\program files\sub dir\program name.exe
(Details at:http://msdn.microsoft.com/en-us/library/ms682425.aspx)
And Chrome doesn't check if it is"GoogleCrashHandler.exe"and give"Program.exe"a System Privilege immediately.So it causes a Path Privilege Escalation Vulnerability.Then you will find the Program.exe get a System Privilege by Windows Taskmgr.

Did this work before? Yes  Chrome shell GoogleCrashHandler.exe

Chrome version: 32.0.1700.102  Channel: stable
OS Version: 5.1 (Windows XP)
Flash Version:

A virus may get System Privileges by this vulnerability.I hold the point of view that i must be fixed.