Google Chrome CVE-2026-7994

Exploitation requires the Chrome Chromoting (Chrome Remote Desktop) feature to be installed and enabled on Windows systems running Chrome versions prior to 148.0.7778.96. The attacker must have local access to the target system (physical presence, prior remote access, or ability to deliver files via network/removable media) and successfully social-engineer the victim into opening a malicious file - the user must actively interact with the file for exploitation to succeed (CVSS: UI:R). Attack complexity is low (CVSS: AC:L) once the file is opened, with no authentication barriers (CVSS: PR:N). Limiting factors that reduce risk: the vulnerability is specific to Windows platforms only (not macOS/Linux/ChromeOS), requires the Chromoting component to be active (not default-enabled in all Chrome installations), and mandates user interaction rather than drive-by exploitation. Environments with AppLocker, strict download policies, or user training on file handling have reduced exposure.

While the CVSS base score of 7.8 indicates high severity, multiple factors reduce immediate enterprise risk. The attack vector is local (AV:L) requiring prior system access, and user interaction is mandatory (UI:R) - the victim must open a malicious file. Attack complexity is low (AC:L) once these prerequisites are met, with no authentication required (PR:N), making this effective for post-compromise privilege escalation scenarios. No CISA KEV listing or public exploit code exists, suggesting this has not been exploited in the wild. The medium Chromium security severity rating (lower than CVSS indicates) aligns with limited real-world exposure. Primary risk applies to shared workstations, managed desktop environments where users may execute untrusted files, or as a secondary payload in multi-stage attacks. SSVC framework suggests delayed patching acceptable for environments with strong download restrictions and user training, but immediate patching warranted for high-risk user populations or unmanaged endpoints.

An attacker with local access (physical or remote shell) to a Windows workstation running vulnerable Chrome delivers a specially crafted file via email attachment, USB drive, or network share. The attacker uses social engineering to convince the victim to open the file, perhaps disguised as a document or legitimate installer. When the user opens the malicious file, Chrome's Chromoting component processes it with improper privilege validation, allowing the attacker's code to execute with SYSTEM-level privileges rather than the user's context. The attacker now has full administrative control of the Windows system, enabling installation of persistent backdoors, credential theft, or lateral movement across the network.