EUVD-2026-93646
GHSA-4h64-g68m-cwhp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Chromoting host over network
-
ExploitSend crafted network traffic
-
ExecutionTrigger incomplete cleanup (CWE-459)
-
ImpactBypass system access restrictions
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | Exploitation requires the target Mac to be running an affected Chrome build (prior to 155.0.8059.39) with the Chromoting / Chrome Remote Desktop functionality active and reachable, since the flaw is in that component and is triggered 'via crafted network traffic.' Per CVSS AV:N/PR:N/UI:N it needs no authentication or user interaction once the vulnerable path is exposed, but exploitation is materially LIMITED by platform (macOS only) and by the Chromoting feature being in use - hosts without Chrome Remote Desktop enabled are not in scope, which is consistent with the vendor's 'Low' severity rating. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/A:H) yields a 9.1 'Critical' score implying trivial remote unauthenticated compromise, yet Google/Chromium rates this 'Low' severity, and EPSS is only 0.17% (6th percentile), indicating very low real-world exploitation probability. It is NOT listed in CISA KEV and no public exploit code is identified, so there is no public exploit identified at time of analysis. The CVSS-vs-vendor-severity gap is the key tension: a CWE-459 'Incomplete Cleanup' weakness that lets an attacker 'bypass system access restrictions' in the Chromoting (Chrome Remote Desktop) component is unlikely to deliver the full confidentiality + availability impact the 9.1 asserts - the vendor's 'Low' rating and the near-floor EPSS both argue the practical impact is modest and conditional on the Chromoting feature being in use. Treat the 9.1 as an outlier likely inflated by generous C:H/A:H scoring; prioritize patching as routine Chrome hygiene rather than as an emergency. Verify the true impact against the Chrome release notes and Chromium issue tracker before escalating. |
| Exploit ScenarioDerived | An attacker on a network path to a Mac running an affected Chrome build with the Chromoting (Chrome Remote Desktop) functionality active sends specially crafted network traffic that triggers an incomplete-cleanup condition, allowing them to bypass intended system access restrictions. No exploit code is publicly identified and EPSS is very low, so weaponization is unlikely at present; the CVSS vector indicates no authentication or user interaction would be required if the vulnerable path is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Incomplete cleanup in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS before 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions using crafted network traffic, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector. Impact is materially constrained: only macOS hosts on an affected build with Chromoting enabled and reachable are in scope, and the realistic outcome is limited information exposure rather than full compromise, which is consistent with the vendor's 'Low' Chromium severity rating. Risk signals conflict sharply - the supplied CVSS score of 9.1 (C:H/I:N/A:H) and the authoritative assessed vector of C:L/I:N/A:N disagree - and must be reconciled before prioritization; EPSS is negligible at 0.17% (6th percentile), there is no KEV listing, and no public exploit identified at time of analysis. Vendor-released patch: Chrome 155.0.8059.39.
RemediationAI
Vendor-released patch: upgrade Google Chrome on macOS to 155.0.8059.39 or later, distributed through the stable channel per the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; on managed fleets, force the update via enterprise policy and verify the reported version, since Chrome's own updater may lag. Where immediate upgrading is not feasible, the most effective compensating control is to disable the Chromoting / Chrome Remote Desktop host functionality on affected Macs entirely - that removes the vulnerable code path but also eliminates legitimate remote-support workflows for those users. Additionally, restrict network reachability of the Chromoting service to trusted management subnets or a VPN rather than leaving it exposed to arbitrary network traffic, which reduces the attack surface for the crafted-traffic trigger at the cost of convenience for roaming users. Monitor macOS permission/TCC prompts and remote-access logs for unexpected activity, and review the upstream issue at https://issues.chromium.org/issues/556215048 for any additional hardening guidance the Chromium team publishes. No public exploit code is known at time of analysis, and EPSS is low (0.17%), so remediation can follow normal patch cycles for hosts where Chromoting is not enabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-459 (Incomplete Cleanup), meaning temporary artifacts, session state, or permission-related resources created by the Chromoting host component are not fully torn down or cleared after use. Residual state of this kind can leave behind handles, cached credentials, or transient macOS access grants that a later request - here, crafted network traffic directed at the exposed Chromoting service - can leverage to sidestep system access restrictions that would otherwise apply. Chromoting is the Chrome Remote Desktop remoting stack; on macOS it interacts with platform-level privacy and permission controls, so incomplete cleanup of those interactions is the plausible bypass mechanism. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms that all Chrome builds below the fixed release are affected, matching the ENISA EUVD affected-version entry for Chrome prior to 155.0.8059.39. Both the vendor score and the independent assessment agree the attack is network-reachable with no privileges (PR:N) and no user interaction (UI:N) required once the vulnerable path is exposed; the disagreement is entirely in impact (integrity/availability claims of the 9.1 score versus the assessed confidentiality-only, low-severity effect), and the assessed vector should govern.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote, no auth or interaction (AV:N/AC:L/PR:N/UI:N), but a CWE-459 incomplete-cleanup access-restriction bypass rated 'Low' by the vendor implies limited confidentiality exposure, not C:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
Executive ViewAI
Google Chrome on macOS (Chromoting/Chrome Remote Desktop) contains a vulnerability that, despite a critical severity label, is assessed as causing only limited information exposure via unauthenticated network traffic, and only on systems with Chromoting enabled and reachable. Vendor-released patch: Chrome 155.0.8059.39. Leadership should ensure rapid patching given the conflicting risk signals, but the immediate organizational impact is low due to constrained scope and negligible exploitation likelihood.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB