Google Chrome CVE-2026-7948

Requires Google Chrome with Chromoting component (Chrome Remote Desktop) installed and accessible on Windows platforms. Exploitation demands precise timing to successfully win the race condition during file processing (AC:H indicates non-trivial complexity requiring specialized knowledge or repeated attempts). User interaction is mandatory (UI:R) - the victim must open or process the malicious file, typically through social engineering. The attacker must already possess local access to the Windows system as an authenticated user (despite CVSS showing PR:N, the 'local attacker' designation in the description indicates some level of existing system access is the realistic prerequisite). Exploitation is limited by the need for Chrome to be running or for the victim to trigger Chromoting file handling. The race condition's success rate depends on system performance characteristics, CPU scheduling, and timing precision, making it unreliable for mass exploitation but viable for targeted attacks with multiple attempts.

Real-world risk is moderate despite the 7.5 CVSS score due to significant exploitation barriers. The CVSS vector shows network attack vector (AV:N) which conflicts with the description's 'local attacker' designation - this discrepancy suggests the CVE record may contain scoring errors and defenders should treat this as a local vulnerability (AV:L would yield lower base score). Attack complexity is High (AC:H), meaning successful exploitation requires precise timing to win the race condition, making it non-trivial and difficult to automate. User interaction is required (UI:R), necessitating social engineering to convince victims to open malicious files. The vulnerability requires existing local access to a Windows system, limiting the attack surface to insider threats, compromised accounts, or secondary exploitation following initial access. No public exploit code exists and CISA has not added this to the KEV catalog, indicating no confirmed active exploitation. EPSS data unavailable but would likely be low given these constraints. Primary risk is in environments where untrusted local users have access (shared workstations, terminal servers, educational labs) or as a post-compromise persistence/escalation technique. For enterprises with standard patching cycles, this represents a routine update priority rather than emergency response.

An attacker with standard user access to a Windows workstation (perhaps through phished credentials or as a disgruntled employee) crafts a malicious file designed to trigger the Chromoting race condition. They socially engineer a victim user with Chrome Remote Desktop enabled to open this file, perhaps disguised as a legitimate document or shared resource. During file processing, the attacker exploits the narrow timing window in the race condition to manipulate Chromoting's privilege context before security checks complete, causing the Chrome process to execute attacker-controlled operations with elevated system privileges. This grants the attacker local administrator or SYSTEM-level access to install persistent backdoors, access protected data, or disable security controls.