Logged-in user context is the permissions, privileges, and access rights of the account currently active on a device. If a standard user is signed in, malware or a malicious file usually inherits standard-user limits; if an administrator is logged in, the same payload may gain much broader control. The term is central to endpoint security because many attacks do not need to “become root” immediately; they only need to run successfully inside whatever account is already in use.
In real attacks, a click on a link, a poisoned document, or a vulnerable desktop app may launch code in the logged-in user’s context. That can be enough to read files, start persistence, steal browser data, or prepare privilege escalation. Defenders reduce the impact by using least privilege, separating admin accounts from daily-use accounts, and watching for suspicious behavior that starts with ordinary user rights and then tries to expand. The phrase often appears in vulnerability reports to describe the exact scope of an exploit’s impact.