EUVD-2026-93641
GHSA-mwxq-889q-4w4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach macOS host running Chromoting
-
ExploitSend crafted network traffic
-
ExecutionBypass incorrect authorization check
-
ImpactAccess restricted system resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running Chrome Remote Desktop (Chromoting) on macOS at a version prior to 155.0.8059.39, with that component network-reachable by the attacker so crafted traffic can reach the vulnerable authorization logic. Limiting factors: the flaw is macOS-specific (Windows/Linux not indicated), it depends on the Chromoting feature being active rather than a default browser install, and Google's Chromium team rated the issue 'Low', indicating the practical access gained is constrained. These conditions materially narrow the exposed population despite the PR:N/UI:N CVSS vector. |
| Impact | Signals conflict sharply and this should NOT be treated as a 9.1-equivalent emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) yields a 9.1 'Critical', implying trivial remote unauthenticated exploitation with high confidentiality and integrity impact. However, Google's own Chromium security team rated this 'Low', a direct and significant contradiction that strongly suggests the real-world impact and/or exploitability is far narrower than the base score implies - likely because exploitation depends on the Chromoting (Chrome Remote Desktop) feature being active on macOS rather than affecting default browser installs. Corroborating the lower end: EPSS is 0.21% (10th percentile), there is no CISA KEV listing (exploitation status: no public exploit identified at time of analysis), and no POC is referenced. Net assessment: this is a high-CVSS-but-low-real-risk issue for the general population; it is a genuine concern only for the subset of macOS users actively running Chrome Remote Desktop. Treat the 9.1 as unreliable and defer to the vendor's 'Low' rating plus the low EPSS; patch during normal cycles rather than as an out-of-band emergency. |
| Exploit ScenarioDerived | A remote attacker who can reach a macOS host running the Chrome Remote Desktop (Chromoting) component sends specially crafted network traffic that is mishandled by an incorrect authorization check (CWE-863), bypassing intended system access restrictions. Because the CVSS vector indicates PR:N/UI:N, no authentication or user interaction is modeled as required, but the attack is only meaningful where the Chromoting service is enabled and network-reachable. No public exploit code is identified at time of analysis, so this remains a theoretical/opportunistic scenario rather than a demonstrated one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authorization bypass in the Chromoting (Chrome Remote Desktop) host component of Google Chrome on macOS prior to 155.0.8059.39 lets remote attackers circumvent macOS system access restrictions by sending crafted network traffic to the remoting service; the provided CVSS vector is AV:N/PR:N/UI:N so the flaw is treated as network-reachable and unauthenticated. Exploitation is conditional rather than opportunistic: it requires Chrome Remote Desktop (Chromoting) to be installed, enabled and network-reachable on a macOS host, and Google's Chromium team rated the underlying defect only 'Low' severity, which is why our independent assessment reduces impact to C:L/I:L/A:N with AC:H instead of the vendor's 9.1. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.21% (10th percentile), so this should not be triaged as a 9.1-equivalent emergency even though the vendor score is high.
RemediationAI
Vendor-released patch: 155.0.8059.39 - update Google Chrome on macOS to that build via the automatic update channel or by checking chrome://settings/help, and in managed environments push the corresponding Chrome release through your enterprise update mechanism, referencing https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the Chromium issue at https://issues.chromium.org/issues/553930843. Where patching cannot be completed immediately, the most effective compensating control is to eliminate the exposure surface rather than the browser: if Chrome Remote Desktop / Chromoting is not business-required on the macOS host, uninstall or disable the host service and revoke its remoting authorization (trade-off: remote administration and remote support of that Mac is lost until re-enabled). Where remote access must remain, restrict network reachability of the remoting listener with host firewall rules or network ACLs so only trusted management subnets or VPN address ranges can reach it (trade-off: off-network and third-party support access breaks, and NAT/tunnel configurations may need redesign). Requiring an authenticated VPN in front of the remoting endpoint adds a second authorization layer ahead of the flawed check (trade-off: additional latency and a dependency on VPN availability). Because no public exploit code is known and EPSS is 0.21% (10th percentile), these measures can be scheduled around normal patch cycles for most fleets, with priority given to macOS hosts that both run Chrome Remote Desktop and expose it to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromoting is the remoting stack that powers Chrome Remote Desktop, and the vulnerable logic sits in the Chrome on macOS build where authorization decisions over system access restrictions are evaluated for remoting connection requests. CWE-863 (Incorrect Authorization) means the component does apply an access-control check but applies it incorrectly, allowing a crafted network request to satisfy, misroute, or skip that check and reach functionality or resources the caller should not be authorized to reach. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected package is Google Chrome itself rather than a separately distributed remoting client, and the fix shipped in the 155.0.8059.39 stable-channel build. The macOS qualifier is material: the bypass depends on the interaction between Chromoting's authorization logic and macOS access restrictions, and Windows or Linux builds are not indicated as affected; the same reason explains why the exploit surface is a feature that must be actively enabled rather than every default browser install. On scoring, the published vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H) describes a trivial unauthenticated full compromise, while our independent assessment keeps AV:N/PR:N/UI:N but raises complexity to High and lowers impact to C:L/I:L/A:N, aligning with Chromium's own 'Low' rating and with the need for a reachable, enabled remoting surface before the authorization flaw can be exercised.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack is remote and unauthenticated but depends on the Chromoting feature being active (AC:H); Chromium's 'Low' rating implies limited C/I impact and no availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
Executive ViewAI
An authorization-bypass flaw in the Chrome Remote Desktop (Chromoting) host component for macOS (CVE-2026-106195) could allow an unauthenticated network attacker to circumvent macOS system access restrictions on endpoints where the remoting service is installed and reachable. Exposure is confined to that subset of managed macOS laptops and desktops, and no public exploit code or confirmed active exploitation has been identified, making this a contained and remediable risk rather than an emergency. Leadership should care because an unpatched remote-access host can become an unmonitored entry point into staff endpoints that hold corporate data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB