CVE-2026-106183 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as missing authorization within the Chromium-based chromoting component of Google Chrome represents a critical failure in access control mechanisms on Windows systems prior to version 155.0.8059.39. This flaw specifically affects the remote desktop functionality, which allows users to connect to and control other computers over a network. The core technical issue lies in the insufficient validation of user permissions when processing incoming network traffic associated with chromoting sessions. Instead of strictly enforcing authorization checks before granting access or transmitting data, the component accepts requests from unauthenticated or unauthorized sources under certain conditions. This architectural oversight creates an avenue for remote attackers to exploit the lack of proper authentication protocols embedded within the communication handshake and session management processes.
From a technical perspective, this vulnerability is classified as CWE-284 Improper Access Control, which encompasses scenarios where an application does not properly restrict access to resources or functions based on user roles or privileges. In the context of chromoting, the absence of rigorous authorization checks allows a remote attacker to craft specific network packets that mimic legitimate connection requests but bypass security gates designed to verify identity and permission levels. By leveraging these crafted network traffic patterns, an adversary can interact with internal services exposed by the chromoting module without valid credentials. This capability effectively neutralizes the intended isolation between different user contexts or system boundaries, allowing unauthorized entities to penetrate deeper into the target environment than permitted by standard security policies.
The operational impact of this vulnerability is significant due to its potential for remote exploitation and information disclosure. A successful exploit enables a remote attacker to obtain sensitive information that should remain confidential within the authorized session context. This could include screen contents, clipboard data, file system access, or other peripheral interactions facilitated by the remote desktop protocol. Since chromoting often runs with elevated privileges to ensure smooth operation of display rendering and input forwarding, compromising this component can lead to broader system compromise beyond just information leakage. The severity is rated as medium because while it does not directly allow arbitrary code execution on its own, the ability to exfiltrate sensitive data or gain unauthorized visibility into a user's desktop activity poses substantial risks to privacy and organizational security posture.
This vulnerability aligns with several tactics within the MITRE ATT&CK framework, particularly those related to Initial Access and Discovery. Attackers may utilize this flaw as part of an initial access strategy by exploiting misconfigured remote services or through social engineering vectors that lead users to initiate connections from malicious sources. Once inside, the ability to view sensitive information supports reconnaissance activities such as Screen Capture (T1113) or Data Staged for Exfiltration. The lack of proper authorization checks also facilitates lateral movement if chromoting is used extensively within an enterprise network, allowing attackers to pivot between systems without triggering standard authentication alerts.
Mitigation strategies primarily involve updating the browser and its underlying Chromium components to version 155.0.8059.39 or later, where these access control checks have been strengthened. Organizations should ensure that automatic updates are enabled for Chrome on all Windows endpoints to maintain patch compliance promptly. Additionally, administrators can reduce exposure by disabling chromoting features if they are not actively required in their environment, thereby removing the attack surface entirely. Network-level controls such as firewalls and intrusion detection systems should be configured to monitor for anomalous traffic patterns associated with remote desktop protocols, particularly those originating from untrusted networks or exhibiting characteristics of crafted exploit attempts. Regular security audits focusing on access control implementations across all browser modules are recommended to prevent similar authorization bypasses in future updates.