Google Chrome EUVD-2026-34631

Exploitation requires the target Linux host to be running Google Chrome with the Chromoting (Chrome Remote Desktop) component active and reachable by the attacker over the network, and the attacker must be able to deliver crafted malicious network traffic to that Chromoting surface. No user interaction is required (UI:N) and no authentication is required (PR:N), but the High attack complexity (AC:H) indicates limiting factors such as timing, race conditions, or specific session/configuration state that the attacker must achieve. Hosts that do not run Chrome Remote Desktop / Chromoting, or that block inbound Chromoting connectivity at the network layer, are not exposed via this path.

Signals are mixed and require careful interpretation. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated network-reachable flaw with full CIA impact, but the High attack complexity (AC:H) indicates non-trivial preconditions such as specific timing, configuration, or active Chromoting sessions. EPSS probability is extremely low at 0.03% (11th percentile) and the CVE is not in CISA KEV, with no public exploit identified at time of analysis - Google itself rated the underlying Chromium severity as Medium despite the higher external CVSS. Notably, the description references 'OS-level privilege escalation' while the CVSS vector is AV:N (network), suggesting the attack chain begins remotely against the Chromoting network surface but ultimately yields local OS privileges; defenders should verify whether the affected host must be running an active Chrome Remote Desktop session for exploitation. Realistic priority is moderate - patch promptly especially on Linux endpoints that use Chrome Remote Desktop, but this does not appear to be a widespread mass-exploitation candidate at this time.

An attacker capable of reaching a Linux host running a vulnerable Chrome with Chromoting active sends crafted malicious network traffic to the Chrome Remote Desktop / Chromoting endpoint, triggering the protection-mechanism failure and escalating from the Chromoting component's context to OS-level privileges on the victim machine. No public exploit has been identified at time of analysis, and the High attack complexity suggests the attacker must satisfy specific timing or state conditions to succeed.