diff --git a/chrome/elevation_service/elevated_recovery_impl.cc b/chrome/elevation_service/elevated_recovery_impl.cc
index f5d778db49439..8387fa7808693 100644
--- a/chrome/elevation_service/elevated_recovery_impl.cc
+++ b/chrome/elevation_service/elevated_recovery_impl.cc
@@ -212,7 +212,10 @@ HRESULT LaunchCmd(const base::CommandLine& command_line,
 
   base::LaunchOptions options = {};
   options.feedback_cursor_off = true;
-  base::GetTempDir(&options.current_directory);
+  // Use the secure temp directory (C:\Windows\SystemTemp under LocalSystem)
+  // rather than C:\Windows\Temp, which grants Authenticated Users create-file
+  // rights and would expose the SYSTEM child to CWD DLL planting (CWE-427).
+  CHECK(base::GetSecureTempDirectory(&options.current_directory));
   base::Process proc = base::LaunchProcess(command_line, options);
   if (!proc.IsValid())
     return HRESULTFromLastError();