External risk intelligence

Chromoting Incomplete Cleanup Bypass Remote Access Restrictions

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-106294

This vulnerability affects Chromoting (Chrome Remote Desktop) component cleanup processes within the browser. Such functionality is typically used for local or managed remote access sessions, not as a public-facing internet edge service, gateway, or web application. It is primarily a client-side or workstation-oriented feature, making common public network exposure unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a security vulnerability identified in the Chromoting component of Google Chrome. While assessed as low severity by Chromium's internal security team, the CVSS score indicates a critical potential impact, noting that it could allow attackers to bypass system access restrictions. The primary concern is to confirm if this specific component is utilized within the organization's environment.

Chrome Remote Desktop has a potential access bypass.
Confirm relevance, as it affects a specialized feature.
Understand potential access restrictions being bypassed.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted network traffic to a vulnerable system, bypassing intended access restrictions. This could potentially lead to unauthorized access or control, exploiting a flaw in how the Chromoting component handles certain operations.

Entry condition: Network access required.
Trigger point: Sending crafted network traffic.
Resulting risk: Bypass system access restrictions.

Live Threat

Current exploitation, exposure, and threat context

Incomplete cleanup within Chromoting on Mac could allow a remote attacker to bypass system access restrictions when specific network traffic is sent.

System access restrictions.
Crafted network traffic.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chromoting component in Google Chrome is likely managed by teams responsible for end-user workstations or internal remote access solutions. The first practical step is to identify all Chrome instances and confirm if the Chromoting feature is enabled and accessible externally, then engage the platform or desktop support teams to prioritize mitigation.

Own by platform or desktop support teams.
Verify Chromoting feature usage and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chromoting in Google Chrome?

Chromoting is the underlying component that powers Chrome Remote Desktop. It enables users to securely access their computer from another device over the internet or a local network. In Google Chrome for Mac, this technology manages the connection lifecycle, including the initialization and termination of remote sessions.

What does CWE-459 mean for CVE-2026-106294?

CWE-459 refers to an incomplete cleanup of a resource. In the context of this CVE, it means that when a remote desktop session ends or performs certain operations, the software fails to properly clear or reset temporary states. This lingering state creates a gap that an attacker could potentially use to circumvent established system security policies.

How can an attacker trigger this vulnerability?

An attacker must send specifically crafted network traffic to a target system where the vulnerable Chromoting component is active. It is important to note that simply visiting a website or browsing the web does not trigger this flaw; the traffic must be designed to interact with the specific communication protocols used by the remote desktop feature.

Is my system likely reachable for this attack?

According to Halo Surface Signal, this is very unlikely for most environments. Because Chromoting is a client-side or workstation feature meant for personal or managed remote access—not a public-facing gateway—it is typically not exposed to the public internet. The risk is significantly lower for devices protected by standard firewalls or those not running active remote desktop sessions.

What should I do if I use Chrome on Mac?

Your first step is to verify whether you actively use the Chrome Remote Desktop feature on your workstations. If the feature is not required, consider disabling it. If you do use it, check your Chrome version to ensure you are updated to at least 155.0.8059.39, where this cleanup issue has been addressed by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.