Google Chrome CVE-2026-11281

Exploitation requires: (1) The attacker has an authenticated local session on the target Windows machine with at least low OS-level privileges (PR:L per CVSS vector - unauthenticated or remote-only attackers cannot trigger this). (2) The victim user must perform some interaction (UI:R) that causes Chromoting to process ETW events, such as initiating or receiving a Chrome Remote Desktop connection. (3) The Chromoting component must be present and active - this component is associated with Chrome Remote Desktop functionality on Windows. (4) The target must be running Windows; the vulnerability does not affect Chrome on macOS, Linux, Android, or ChromeOS due to ETW being a Windows-exclusive subsystem. Exploitation is limited by: the requirement for pre-existing local authenticated access, mandatory user interaction, and the Windows-only platform scope. The impact is read-only (no write or execution primitive), making this an information disclosure scenario rather than a code execution path.

CVSS 5.0 (Medium) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N reflects a constrained but meaningful disclosure risk. The local attack vector (AV:L) limits exposure to cases where the attacker already has a foothold on the victim's Windows machine. Low attack complexity (AC:L) means no race conditions or specialized environment setup is required once access is established. Low privileges (PR:L) indicate the attacker must be an authenticated OS user - unauthenticated remote exploitation is not possible. User interaction (UI:R) adds a further gating condition, meaning the victim must perform some action (e.g., triggering Chromoting activity) for the overflow to be reachable. Confidentiality impact is rated High despite a medium overall score because process memory contents could include credentials, tokens, or session data. EPSS at 0.01% (1st percentile) strongly suggests no observed mass exploitation. KEV status: not listed - no confirmed active exploitation. No public exploit code identified at time of analysis. Google rated this Low severity internally (Chromium security severity: Low), which is consistent with the attack prerequisites. Overall: this is a low-urgency patching priority for most organizations, with highest relevance in shared or multi-user Windows environments where untrusted local users exist.

An attacker who has already gained low-privileged local access to a Windows machine running a vulnerable version of Chrome waits for or induces a scenario in which the victim user triggers Chromoting activity (such as a Chrome Remote Desktop session). The attacker then injects or submits a crafted ETW event designed to trigger the integer overflow in the Chromoting component, causing it to read out-of-bounds from the Chrome process memory and return data - potentially including session tokens, authentication credentials, or other sensitive in-memory content - accessible to the attacker's process. No public proof-of-concept exploit has been identified at time of analysis.