Google Chrome EUVD-2026-65768

Exploitation requires the target Windows system to have Chrome Remote Desktop (Chromoting) active and its network listener reachable by the attacker - this is not a default Chrome configuration and affects only users who have installed and enabled Chrome Remote Desktop. The attacker must be able to deliver crafted network traffic directly to the Chromoting listener, requiring either internal network access or that the Chromoting port is exposed externally. The CVSS AC:H rating confirms that additional exploitation conditions beyond mere reachability apply, consistent with the heap-spray or race-condition requirements typical of use-after-free sandbox escapes. Exploitation is limited to Windows platforms only. Standard Chrome browser users who have not installed or enabled Chrome Remote Desktop are not exposed to this vulnerability.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable flaw requiring no authentication, but the High Complexity (AC:H) rating is a meaningful moderating factor - exploitation requires precise memory-state conditions or race-condition timing. Despite the high CVSS, EPSS scoring at 0.28% (20th percentile) confirms limited observed exploitation activity and suggests threat actors have not yet operationalized this vulnerability at scale. No CISA KEV listing and no public POC exist at time of analysis. The vendor-confirmed CVSS scope designation of S:U is notable, though the description's explicit mention of code execution 'outside the sandbox' arguably implies a scope change to the host OS - this inconsistency should be verified against the Chromium security team's rationale. Organizations operating Chrome Remote Desktop at scale face the highest realistic exposure given Chromoting's network listener is the specific attack surface; deployments that do not use Chrome Remote Desktop are not exposed. The AC:H constraint means that even a modest defensive measure - disabling Chromoting where not needed - substantially reduces realistic risk.

An attacker with network access to a Windows host running an active Chrome Remote Desktop session sends crafted Chromoting protocol packets that trigger a use-after-free condition in the Chromoting memory handler. The memory corruption is weaponized to redirect execution flow past Chrome's sandbox boundary, yielding arbitrary code execution with the privileges of the Chrome process on the host OS. Successful exploitation requires meeting the AC:H conditions - likely precise heap-layout manipulation or race-condition timing - and no public proof-of-concept is known at time of analysis.