Google Chrome CVE-2026-84334

The target system must be running Google Chrome on Windows (not macOS or Linux) in a version prior to 152.0.7977.75, and the Chromoting (Chrome Remote Desktop) component must be installed and active or accessible on that host. The attacker must have local access to execute a program on the machine - the AV:L vector rules out remote exploitation without a prior foothold. The AC:H metric indicates that specific conditions (such as system state, timing, or service configuration) must be present for the authorization flaw to be reliably triggered, meaning opportunistic or automated exploitation is constrained. Defenders can eliminate the attack surface by disabling or uninstalling the Chrome Remote Desktop host service on Windows endpoints where remote desktop is not required, and by enforcing local application execution controls to limit what programs an attacker-controlled account may run.

The CVSS 8.1 vector (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a local, high-complexity attack with no privilege prerequisite, culminating in full post-sandbox code execution - a combination typical of a sandbox escape primitive with a non-trivial exploitation bar. The AC:H metric is significant: it acknowledges that specific system state or sequencing conditions must be met, meaningfully reducing opportunistic exploitability compared to straightforward AV:N/AC:L issues. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis; notably, Google's internal Chromium team rates this 'Medium' severity, a downgrade from the NVD CVSS 8.1 'High,' which reinforces that exploitation is considered non-trivial by the discoverers themselves. That said, even a mid-sized municipal IT team in radom should treat this as urgent given that a successful exploit yields C:H/I:H/A:H impact - full host compromise outside Chrome's sandboxing layer - and Chrome Remote Desktop is commonly enabled in enterprise and support workflows, expanding the potential attack surface beyond individual consumer machines. EPSS data and KEV status are absent from source data, so likelihood cannot be quantified beyond the CVSS complexity signal.

A local attacker with the ability to run a program on a Windows host running a vulnerable Chrome version exploits the Chromoting authorization flaw by sending crafted requests to the Chromoting service that bypass its authorization checks. The malformed interaction causes Chromoting to perform privileged operations on behalf of the attacker's local program, effectively breaking the Chrome sandbox boundary and granting code execution in the unsandboxed host context. No public exploit code has been identified at time of analysis.