Google Chrome CVE-2026-106183

Requires that the Chrome Remote Desktop (Chromoting) functionality is in use on the target Windows host running Chrome prior to 155.0.8059.39, and that the attacker can send crafted network traffic to the remoting endpoint. The CVSS AC:H rating means exploitation is gated by conditions the attacker cannot fully control - plausibly an active or establishing remoting session, specific protocol state, or timing - which limits reliability. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the dependence on the Chromoting feature being active is the key limiting factor; hosts not using Chrome Remote Desktop are not exposed.

This is a genuinely moderate-priority issue rather than a false alarm, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, but the High attack complexity (AC:H) indicates exploitation depends on conditions outside the attacker's control (e.g. an active Chrome Remote Desktop/Chromoting session and specific timing or state), which materially lowers real-world likelihood. Impact is confidentiality-only (C:H/I:N/A:N) - information disclosure, not code execution - consistent with Chromium's self-assigned Medium severity and the 5.9 base score. No EPSS score was supplied, so exploitation probability cannot be quantified; this gap should be noted explicitly. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. Net: patch in normal cadence - the AC:H condition and confidentiality-only impact make this lower urgency than the network/unauthenticated vector alone would suggest.

An attacker positioned on the network path to a host running Chrome Remote Desktop (Chromoting) sends crafted network traffic to the remoting endpoint, exploiting a missing authorization check to read data it should not have access to. Because attack complexity is High, the attacker must satisfy conditions such as an active remoting session or precise timing, and the payoff is disclosure of sensitive information rather than control of the host. No public exploit code is identified at time of analysis.