Google Chrome EUVD-2026-27953

Requires three specific prerequisites: First, the Chrome Remote Desktop (Chromoting) feature must be installed and accessible on the target Windows system - this is not enabled by default and requires explicit user installation of the Chrome Remote Desktop extension. Second, local access to the target machine is required (AV:L), meaning the attacker must already have a local user account, physical access, or a prior foothold through other malware. Third, user interaction (UI:R) is mandatory - the victim must actively open or process the malicious file through Chromoting functionality, requiring social engineering success. No special authentication is required once local access is established (PR:N), meaning even unprivileged local users can trigger the vulnerability. Exploitation is LIMITED by the need for Chromoting to be installed and active; standard Chrome browser installations without the Remote Desktop extension are not vulnerable. Additionally, the Windows platform requirement excludes Linux, macOS, and ChromeOS deployments from risk.

Real-world risk is MODERATE despite the high CVSS 7.8 score. The CVSS vector AV:L/AC:L/PR:N/UI:R indicates local access with user interaction required, significantly constraining exploitation compared to remote vulnerabilities. Attackers need existing local access and must socially engineer victims to interact with malicious files - not a drive-by remote exploit. However, the privilege escalation from user-level to OS-level (SYSTEM) represents severe impact once prerequisites are met. No EPSS data provided, but the local-only vector typically correlates with lower mass exploitation probability. Not present in CISA KEV, confirming no widespread active exploitation detected. The 'Privilege Escalation' tag and high Chrome security severity rating indicate Google considers this a serious issue for targeted attacks. Primary risk scenarios: compromised user accounts seeking privilege escalation, malware delivery chains requiring local foothold first, or insider threat scenarios. For enterprises with strict least-privilege policies, this represents a boundary-breaking vulnerability warranting priority patching. For consumer single-user systems, risk is lower as attackers already at local user level often have sufficient access for typical objectives.

An attacker with an existing foothold on a Windows system (via phishing, USB drop, or compromised user account) plants a malicious file formatted to trigger the Chromoting use-after-free condition. The attacker then uses social engineering to convince the victim to open or interact with the file through Chrome Remote Desktop functionality, perhaps disguised as a legitimate remote session configuration or shortcut. When processed, the crafted file triggers the memory corruption, allowing the attacker to execute arbitrary code in the context of the Chromoting process. Because Chromoting may run with elevated privileges for remote access functionality, successful exploitation escalates the attacker from standard user to SYSTEM-level access, enabling installation of persistent rootkits, credential theft from privileged processes, or complete system compromise. The low attack complexity (AC:L) suggests reliable exploitation once file interaction occurs.