EUVD-2026-50626
GHSA-96rv-m324-862p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to Linux host
-
DeliverySend malicious traffic to Chromoting host
-
ExploitTrigger improper privilege handling
-
ExecutionEscalate to OS-level privileges
-
ImpactFull control of system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Linux system to be running Chrome (prior to 151.0.7922.72) with the Chromoting / Chrome Remote Desktop host component active and reachable - this is the specific, non-default deployment condition that makes the flaw exploitable. The attack is bounded by the CVSS local vector (AV:L): the attacker must be able to deliver the malicious network traffic to the Chromoting host, implying local presence or network reachability to that host process, and is limited to Linux (Chrome on other platforms is not indicated). No authentication (PR:N) or user interaction (UI:N) is required per the vector. Note the description's 'malicious network traffic' phrasing conflicts with the AV:L designation, so the exact reachability precondition should be confirmed with the vendor. |
| Impact | The signals are mixed and warrant careful triage. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.4 with high impact across confidentiality, integrity, and availability, and SSVC reports 'total' technical impact - yet SSVC also marks Exploitation as 'none' and Automatable as 'no,' and EPSS is very low at 0.11% (2nd percentile), so this is not a widespread mass-exploitation candidate. There is a notable descriptive tension: the vector is AV:L (local attack vector) and PR:N, but the description says escalation occurs 'via malicious network traffic,' which reads as a remote delivery element - verify with the vendor whether an attacker needs pre-existing local presence or can trigger it purely over the network, as this materially changes exposure. Chromium rated the underlying severity only Medium despite the 8.4 NVD-style score, reflecting that real-world preconditions (Chromoting must be in use) constrain reach. Net: a genuine privilege-escalation concern for hosts running Chrome Remote Desktop on Linux, but not an emergency for the typical Chrome fleet that does not enable Chromoting. |
| Exploit ScenarioDerived | An attacker with a foothold on a Linux workstation running Chrome Remote Desktop sends malicious network traffic to the Chromoting host process, which mishandles the input and performs a privileged operation on the attacker's behalf, elevating them from an unprivileged local user to OS-level privileges. Because the CVSS vector is AV:L/AC:L with no privileges or user interaction required, exploitation is low-complexity once the attacker can reach the host, though no public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 30, 2026
Local OS-level privilege escalation in Google Chrome on Linux before 151.0.7922.72 stems from an inappropriate implementation in the Chromoting (Chrome Remote Desktop) component, letting a local attacker leverage malicious network traffic to gain elevated OS privileges. Rated CVSS 8.4 (Chromium severity Medium), the flaw carries total technical impact but no public exploit identified at time of analysis and a low EPSS of 0.11% (2nd percentile), indicating minimal current exploitation pressure. A vendor patch is available and no active exploitation has been reported.
Earlier versions of this analysis (1)
Privilege escalation in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Linux versions prior to 151.0.7922.72 lets an adjacent attacker gain OS-level privileges by sending crafted malicious network traffic. Rated Medium by Chromium but scored CVSS 7.5 due to full confidentiality, integrity, and availability impact, it currently has no public exploit identified at time of analysis and is not listed in CISA KEV. The high attack complexity and adjacent-network vector meaningfully constrain real-world exploitation.
RemediationAI
Vendor-released patch: update Google Chrome on Linux to 151.0.7922.72 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html), then relaunch the browser and any Chrome Remote Desktop host to load the fix. As an interim compensating control where immediate patching is not possible, disable or uninstall the Chrome Remote Desktop host on affected Linux systems so the vulnerable Chromoting code path is not reachable - the trade-off is loss of remote desktop access to those machines. Additionally restrict network access to the Chromoting host ports and limit local user access on multi-user Linux hosts to reduce the pool of potential local attackers, accepting that this narrows legitimate remote-access workflows. Confirm the running Chrome version through chrome://settings/help after updating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromoting is the internal codename for Google's Chrome Remote Desktop functionality, which brokers remote desktop sessions and handles network-delivered session traffic on the host. The weakness is classified as CWE-269 (Improper Privilege Management), meaning the component fails to correctly enforce or drop privileges when processing input, allowing an actor to cross a trust boundary into higher-privileged OS context. Per the CPE data (cpe:2.3:a:google:chrome), the issue is specific to the Chrome application on Linux, where the Chromoting host process interacts with OS-level privilege mechanisms; a mishandled implementation path lets crafted network traffic influence a privileged operation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector and the need for an existing foothold to reach the Chromoting host imply PR:L; total OS-level compromise yields C:H/I:H/A:H with unchanged scope.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
6DescriptionCVE.org
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Linux systems before version 151.0.7922.72 contains a privilege escalation vulnerability that exposes organizations to insider threat and account compromise scenarios. This affects employees running affected Chrome versions on shared or multi-user Linux systems, potentially allowing unauthorized access to sensitive corporate resources and data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB