What is the CVSS score of EUVD-2026-30408?

EUVD-2026-30408 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30408?

Yes, a patch is available for EUVD-2026-30408. Update the affected software to the latest version immediately.

Chrome Remote Desktop EUVD-2026-30408

| CVE-2026-8586 MEDIUM

Improper Access Control (CWE-284)

2026-05-14 Chrome

GHSA-v69h-h5h3-8pcv

Google Authentication Bypass Red Hat Suse Chrome

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

MEDIUM

qualitative

Red Hat

3.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:27 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

5.5 (None) 5.5 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Discretionary access control bypass in Chrome Remote Desktop (Chromoting) allows adjacent network attackers to achieve limited confidentiality, integrity, and availability impact through a malicious file requiring user interaction. Google released Chrome 148.0.7778.168 to address this medium-severity flaw. EPSS score of 0.01% (1st percentile) and CISA SSVC assessment indicate low real-world exploitation probability with no observed exploitation activity. The adjacent network attack vector (AV:A) significantly constrains attacker positioning compared to typical remote vulnerabilities.

Technical ContextAI

Chrome Remote Desktop (Chromoting) is Google's remote access solution integrated into Chrome for cross-platform desktop sharing. The vulnerability stems from an inappropriate implementation (CWE-284: Improper Access Control) that fails to properly enforce discretionary access control (DAC) mechanisms. DAC systems restrict access based on user identity and ownership - this flaw allows attackers to circumvent those restrictions when processing specially crafted files. The affected CPE (cpe:2.3:a:google:chrome) indicates the vulnerability resides in the Chrome application bundle rather than the standalone Chromoting client, suggesting the remote desktop functionality embedded within the browser is the attack surface. The adjacent network attack vector (AV:A) indicates exploitation requires the attacker to be on the same local network segment as the victim, such as shared Wi-Fi, corporate LAN, or compromised network infrastructure.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.168 or later through the browser's built-in update mechanism (Settings → About Chrome) or enterprise deployment tools. Google's Stable Channel Update from May 12, 2026 (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html) provides the patched release. Chrome's automatic update feature typically deploys fixes within 48 hours for most users. For environments requiring compensating controls before patch deployment: restrict Chrome Remote Desktop usage to trusted networks only by blocking Chromoting network traffic at the perimeter firewall; configure endpoint security to quarantine unverified files before user interaction; and implement application whitelisting to prevent execution of untrusted files in directories accessible to Chrome processes. Note that disabling Chrome Remote Desktop entirely eliminates the attack surface but impacts remote work capabilities. Network segmentation reduces adjacent network attack exposure but requires infrastructure changes and may not be feasible for mobile/roaming users.