CVE-2026-106195 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an incorrect authorization flaw within the Chromoting component of Google Chrome on macOS represents a significant breach in application-level access control mechanisms. This issue, resolved in version 155.0.8059.39 and classified with low severity by the Chromium security team, stems from insufficient validation of user privileges when handling remote connection requests. The core technical flaw lies in the failure to properly verify whether the initiating entity possesses the necessary system-level permissions before granting access or executing specific commands through the Chromoting interface. This misconfiguration allows a remote attacker who can interact with the network traffic directed at the Chrome application to bypass established security boundaries, effectively circumventing operating system restrictions designed to limit user actions and data exposure.
From an operational perspective, this vulnerability enables unauthorized entities to exploit the trust relationship between the browser's remote desktop functionality and the underlying macOS environment. By crafting specific network packets that mimic legitimate Chromoting traffic but omit or manipulate authorization tokens, an attacker can trick the application into performing privileged operations without proper authentication. This bypass of system access restrictions could potentially lead to unintended information disclosure, unauthorized modification of local files, or further lateral movement within a compromised host if additional privileges are inadvertently granted through this channel. The impact is particularly relevant in enterprise environments where remote desktop tools are frequently used for technical support and administration, as it undermines the integrity of session management protocols.
In terms of industry standard classifications, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically highlighting failures in enforcing least privilege principles during runtime operations. Furthermore, the exploitation vector relates to ATT&CK technique T1078, Valid Accounts, as it involves leveraging legitimate system access mechanisms through improper authorization checks rather than direct credential theft. The ability to bypass restrictions via crafted network traffic also touches upon aspects of CWE-284, Improper Access Control, where the application fails to enforce appropriate controls on authenticated users or services.
Mitigation strategies primarily involve ensuring that all instances of Google Chrome are updated to version 155.0.8059.39 or later, which contains the necessary patches for authorization validation logic within Chromoting. Organizations should also implement network segmentation policies to restrict access to remote desktop ports and monitor for anomalous traffic patterns indicative of crafted requests targeting browser-based services. Additionally, enforcing strict application whitelisting and disabling unnecessary remote assistance features when not in active use can reduce the attack surface associated with this component. Regular security audits focusing on privilege escalation vectors within third-party applications are recommended to identify similar authorization flaws before they can be exploited by malicious actors seeking to gain unauthorized system access.