Google Chrome EUVD-2026-65769

Exploitation requires two concrete preconditions: (1) the target system must have Chrome Remote Desktop (Chromoting) actively in use on Windows - this is not a default Chrome feature and requires deliberate installation and session establishment; (2) the attacker must have already achieved compromise of the Chrome renderer process, which itself typically requires a separate renderer-level vulnerability to be chained. UI:R in the CVSS vector indicates user interaction is required, consistent with the victim having an active Chromoting session open. PR:N indicates no authentication is required from the attacker's perspective once these preconditions are met. Exploitation is therefore NOT possible against a default Chrome browser installation without Chromoting active, and NOT possible as a single-step remote attack - the renderer compromise is a mandatory prerequisite, significantly limiting opportunistic exploitation compared to a standalone RCE.

The CVSS 8.3 score reflects a high-severity, network-reachable sandbox escape with full confidentiality, integrity, and availability impact, but two signals meaningfully temper real-world urgency. First, AC:H explicitly encodes the requirement that the renderer process has already been compromised - this is a second-stage exploitation primitive rather than a standalone remote code execution path; an attacker must chain this with a separate renderer exploit. Second, EPSS at 0.28% (20th percentile) indicates that exploitation activity is not observed or predicted at broad scale, which is consistent with the high attack complexity. No CISA KEV listing exists and no public POC has been identified at time of analysis, so this is not being actively weaponized broadly. That said, the S:C scope change and PR:N (no credentials required once renderer access is obtained) make this highly valuable as a sandbox-escape link in a browser exploit chain. Organizations with Chrome Remote Desktop broadly deployed on Windows workloads should treat this as a priority patch, since it can be a critical enabler in multi-stage browser attacks.

An attacker who has already compromised the Chrome renderer process on a Windows endpoint - for example, via a separate browser vulnerability triggered by a malicious web page - sends crafted Chromoting protocol network traffic to the active remote desktop session. The malformed traffic triggers a use-after-free condition in the Chromoting component, allowing the attacker to corrupt freed heap memory and redirect execution flow. Code is executed outside the Chrome sandbox at the browser process privilege level, enabling full system access. No public exploit code has been identified at time of analysis.