EUVD-2026-40747
GHSA-rxj2-2vwr-7xr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access as standard user
-
DeliveryPlant malicious file for Chromoting
-
ExploitVictim interacts with the file
-
ExecutionInsufficient input validation triggers
-
PersistExecute in elevated context
-
ImpactEscalate privileges on Windows host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires local access to the Windows host and that the Chromoting (Chrome Remote Desktop) functionality of Google Chrome be present/active, plus user interaction (UI:R) - the victim must open or otherwise interact with the attacker-supplied malicious file for the escalation to trigger. Limiting factors: the attack vector is local only (AV:L), so no remote/network exploitation is possible; the requirement that a user interact with the malicious file rules out silent automated escalation; and platforms other than Windows are not indicated as affected. No elevated privileges are needed to stage the attack (PR:N), but the dependency on both local presence and user interaction meaningfully narrows realistic exploitation. |
| Impact | The signals are internally consistent and point to a real but bounded risk. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local-only attack surface requiring victim interaction, which matches the 'malicious file' description and explains why Chromium graded it Low despite a 7.8 base score driven by high C/I/A impact. EPSS is very low (0.13%, 3rd percentile) and the CVE is NOT in CISA KEV, with no POC referenced - so this is not a mass-exploitation candidate. The high CVSS is impact-weighted, not exploitability-weighted: an attacker still needs local access and user interaction, limiting realistic scale. This is a patch-in-normal-cycle priority for standard endpoints, elevated only where untrusted local users share Windows hosts running Chrome Remote Desktop. |
| Exploit ScenarioDerived | A low-privileged user (or malware already running as a standard user) on a shared Windows machine drops a specially crafted file where the Chromoting component will process it, then induces the logged-in victim to open or trigger it. Because the file's input is not properly validated, processing occurs in an elevated context and the attacker gains higher privileges. No public POC has been identified, and the local vector plus required user interaction (UI:R) constrain the attack to hands-on-host scenarios. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Local privilege escalation in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows before 150.0.7871.47 allows a local attacker who plants a malicious file to elevate privileges after the victim interacts with it. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a 7.8 CVSS but was rated Low severity by Chromium's own team. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.13%, 3rd percentile), consistent with a local, interaction-dependent issue rather than a mass-exploitable one.
RemediationAI
Vendor-released patch: Google Chrome 150.0.7871.47 for Windows - upgrade to this version or later, which Chrome typically applies automatically on restart, so ensuring the browser is fully closed and relaunched is the primary fix (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). In managed fleets, push the update via your enterprise management/GPO and verify the running version. As an interim compensating control until patched, disable or uninstall Chrome Remote Desktop (Chromoting) on hosts that do not require it and restrict interactive/local login to trusted users, since exploitation depends on a local attacker planting a file and a user interacting with it; the trade-off is loss of remote-desktop functionality for legitimate users on those hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromoting is the internal codename for the Chrome Remote Desktop subsystem bundled with Google Chrome, which brokers remote-access sessions and handles associated host/client files on the Windows platform. The root cause is classified as CWE-20 (Improper Input Validation): the component accepts a file whose contents or path attributes are not sufficiently checked, so a maliciously crafted file can influence execution in a higher-privileged context. Because Chromoting components can run with elevated rights on Windows (host services, native messaging helpers), a validation gap in how these files are parsed or loaded provides a route from a low-privileged local user to escalated privileges.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector (AV:L) needing no prior privileges (PR:N) but victim interaction (UI:R); successful privilege escalation yields full high C/I/A on the host.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)
Executive ViewAI
Chrome Remote Desktop on Windows (versions before 150.0.7871.47) contains a privilege escalation vulnerability allowing local attackers to gain administrative access. Successful exploitation would enable installation of malware, data theft, and lateral movement through the network. Though real-world exploitation risk remains low due to attack complexity, timely patching of remote-work infrastructure is important to maintain security.
Vendor-released patch: Chrome version 150.0.7871.47 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB