Google Chrome EUVD-2026-93643

Exploitation requires that the victim be using the Chromoting feature (Chrome Remote Desktop) and be induced via social engineering (UI:R) to perform an action that opens the vulnerable code path. The attacker must then deliver crafted network traffic and win a timing-dependent race condition (CWE-362, reflected in AC:H), which is inherently probabilistic and unreliable. No authentication is needed on the attacker side (PR:N), but the combined requirements of active victim interaction, use of the Chromoting feature, and successfully winning the race window substantially limit realistic exploitation. Affected builds are Chrome desktop prior to 155.0.8059.39; the fix is delivered via Chrome's auto-update, so patched installations are not exposed.

Signals are consistent and collectively point to a LOW real-world priority despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) yields only 5.3 (Medium), and Google itself rated the Chromium severity as Low. Key friction factors: AC:H reflects the probabilistic nature of winning a race condition (CWE-362), and UI:R confirms the description's 'leveraging social engineering' - a victim must be induced to act. EPSS is 0.14% (3rd percentile), among the lowest tiers, and the CVE is NOT in CISA KEV, with no public exploit identified at time of analysis. These exploitation signals agree rather than conflict: low probability, no observed exploitation, high attack complexity, and required user interaction all align. The 'Authentication Bypass' tag and 'bypass system access restrictions' phrasing map to the I:H (integrity) impact with C:N/A:N, meaning the flaw undermines an access boundary rather than directly stealing data or causing denial of service. Net: a legitimately network-reachable but hard-to-exploit, interaction-dependent, integrity-only issue in a patched browser - real but not urgent. It should be remediated through routine Chrome auto-update, not emergency patching.

An attacker lures a Chrome user (via social engineering, e.g. a malicious page or link) into initiating or accepting a Chromoting/Chrome Remote Desktop interaction, then sends crafted network traffic timed to win a race window. If the race is won, the attacker bypasses a system access restriction to tamper with resources that should be protected. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation difficult.