CVE-2026-84334 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization flaw within the Chromoting component of Google Chrome on Windows operating systems prior to version 152.0.7977.75 represents a significant breach in privilege management and sandbox isolation mechanisms. This specific defect allows for unauthorized access control failures where the application fails to properly validate the identity or permissions of local programs attempting to interact with Chromoting services. In modern browser architectures, components like Chrometing are designed to operate within strict security sandboxes that limit their ability to execute code or access system resources outside a restricted environment. However, when authorization checks are incorrectly implemented or bypassed, this protective boundary is compromised, effectively neutralizing the sandbox's primary function of containing potential threats and preventing lateral movement within the host system.
From a technical perspective, the core issue lies in how local programs authenticate themselves to the Chromoting service. If the application does not rigorously verify that an incoming request originates from a trusted source or possesses the necessary elevated privileges, it may accept commands or data payloads intended for administrative functions. This misconfiguration enables a local attacker who has already gained some level of access on the system to exploit this weakness. By crafting specific requests that mimic legitimate internal communications but lack proper authorization tokens or signatures, an attacker can trick the Chromoting module into executing arbitrary code with higher privileges than those held by the attacking process itself. This escalation is particularly dangerous because it bypasses standard user-level restrictions and leverages the inherent trust placed in browser components to gain deeper system access.
The operational impact of this vulnerability is severe due to its potential for remote code execution capabilities, albeit triggered locally. An attacker who exploits this flaw can execute arbitrary commands on the victim's machine with the privileges granted to the Chrome process or associated services. This could lead to full system compromise, allowing the installation of malware, exfiltration of sensitive data stored in browser profiles, or use of the compromised device as a pivot point for further attacks within a network environment. The severity is classified as medium by Chromium security standards because while it requires local access initially, the resulting privilege escalation significantly amplifies the risk profile compared to typical sandbox escapes that remain confined to user-level permissions.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where a principal does not properly establish its own identity or privileges before performing an action. Furthermore, in terms of adversary tactics and techniques, this exploitation path corresponds to ATT&CK technique T1055, Process Injection, or more broadly T1068, Exploitation for Privilege Escalation. Attackers would likely utilize local exploits that leverage the flawed authorization logic to inject code into privileged processes or execute binaries with elevated rights, thereby establishing persistence or expanding their foothold on the compromised host.
Mitigation strategies primarily involve immediate patching of the Google Chrome browser to version 152.0.7977.75 or later, which addresses the underlying authorization checks within the Chromoting component. Organizations should ensure that automatic updates are enabled for all endpoints running Windows and affected versions of Chrome to prevent exploitation windows from remaining open. Additionally, implementing strict application whitelisting policies can help restrict which local programs are permitted to interact with browser components, reducing the attack surface even if similar vulnerabilities exist in unpatched software. Regular security audits focusing on privilege escalation vectors and sandbox integrity checks should also be conducted to identify other potential misconfigurations that could facilitate similar attacks.