External risk intelligence

Chromium Authorization Bypass in Google Chrome on macOS Allows Network Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-106195

Chromoting (Chrome Remote Desktop) is a feature used for remote access. While it involves network traffic, it is typically configured for personal or specific enterprise use rather than being an internet-facing service or public gateway. Exposure generally requires specific user enablement and configuration, making broad public-internet-facing exposure uncommon in typical deployment patterns.

Google Chrome

before 155.0.8059.39

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an authorization vulnerability within Google Chrome's Chromoting feature, impacting macOS users. The flaw could permit unauthorized access to system resources through specifically designed network communications. While classified as a critical severity, the potential for exploitation relies on the Chromoting feature being actively used and potentially exposed.

Unrestricted access to system features is possible.
Protects against unauthorized remote access.
Assess Chromoting usage and network exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic, potentially bypassing intended access restrictions. The Chromoting feature in Google Chrome is susceptible to this bypass, which could allow unauthorized access to system resources.

No special access required.
Triggered via network traffic.
Bypasses system access restrictions.

Live Threat

Current exploitation, exposure, and threat context

A flaw in Chromoting within Google Chrome could allow a remote attacker to bypass system access restrictions. This occurs when the system receives specially crafted network traffic, potentially affecting access controls when the feature is active and supported by the advisory.

System access controls could be bypassed.
Specially crafted network traffic could cause exposure.
Unauthorized access to system resources may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome's Chromoting feature on macOS, potentially allowing unauthorized access via network traffic. Responsibility likely falls to teams managing Chrome deployments and the macOS infrastructure, with initial steps involving asset discovery, exposure assessment, and owner identification.

Chrome and macOS platform owners.
Verify Chromoting reachability and impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chromoting in Google Chrome?

Chromoting is the underlying technology for Chrome Remote Desktop. It allows users to remotely access their computer or share their screen with others through the browser. This feature is integrated into Google Chrome across various operating systems, including macOS, to facilitate secure remote connections.

How does CVE-2026-106195 cause a security vulnerability?

This vulnerability is classified as CWE-863, which refers to incorrect authorization. Essentially, the software fails to properly verify if a user has permission to perform an action. In the context of CVE-2026-106195, this flaw allows a remote attacker to bypass system access restrictions that would normally prevent unauthorized operations.

What triggers this Chrome vulnerability?

The issue is triggered when the system receives specifically crafted network traffic aimed at the Chromoting component. It is important to note that the vulnerability does not trigger through standard browsing or routine web activity; it requires interaction with the Chromoting feature itself to exploit the authorization bypass.

Is my macOS system exposed to this threat?

According to Halo Surface Signal, broad exposure is unlikely because Chromoting is typically configured for personal or specific enterprise use rather than as a public-facing service. However, if you have actively enabled Chrome Remote Desktop, your system may be reachable via network traffic, which increases the potential relevance of this vulnerability.

What should I do to address CVE-2026-106195?

The primary response is to update your Google Chrome browser to version 155.0.8059.39 or later, which contains the necessary security patch. As a preliminary step, you should also identify which machines in your environment have the Chromoting feature enabled and verify that they are running the updated software version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.