Google Chrome CVE-2026-76017

Exploitation requires that the victim is running Google Chrome prior to 151.0.7922.173 with the Chrome Remote Desktop (Chromoting) component active - either installed and running as a host, or in an active remote desktop session. The victim must take some form of user interaction (UI:R per CVSS), consistent with initiating or accepting a Chromoting connection. Exploitation is limited by: (1) the Chromoting component must be active and reachable over the network; (2) user interaction is required, ruling out fully passive exploitation; (3) SSVC rates it as non-automatable, implying reliable exploitation likely requires targeted crafting or session-specific state. The attack does NOT require authentication (PR:N). Environments that do not use Chrome Remote Desktop and have not installed the Chromoting extension are not exposed to this specific vulnerability surface.

CVSS 8.8 (High/near-Critical) reflects network-reachable, unauthenticated (PR:N), low-complexity exploitation requiring only user interaction (UI:R), with full C/H/I/A impact. However, EPSS places this at only 0.36% exploitation probability (29th percentile), and CISA SSVC rates exploitation as 'none' and automatable as 'no', suggesting real-world exploitation has not been observed at scale. The SSVC 'Technical Impact: total' aligns with the out-of-sandbox code execution claim. A meaningful tension exists: CVSS S:U conflicts with 'outside the sandbox' in the description - true sandbox escape in Chrome should yield S:C and a higher base score (~9.6); this discrepancy should be verified with the vendor or NVD. The non-automatable SSVC assessment implies the attack requires some degree of targeting or specific session state, limiting mass-exploitation risk despite the network vector. Patch is confirmed available. Overall: high severity in theory, moderate current real-world exploitation risk given EPSS/SSVC signals.

An attacker who can reach a victim's machine over the network - for example, on a shared network or via the internet if Chromoting ports are exposed - sends specially crafted Chromoting protocol traffic to a Chrome instance where Chrome Remote Desktop is active. The malformed packets trigger a use-after-free in the Chromoting component, allowing the attacker to corrupt memory and redirect execution flow, ultimately running arbitrary code in a context outside the Chrome sandbox with the privileges of the browser process or host OS user. No public exploit code has been identified at time of analysis.