External risk intelligence

Chromoting Local Authorization Bypass in Google Chrome

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121157

The vulnerability involves incorrect authorization in Chromoting (Chrome Remote Desktop) that requires a local attacker to bypass system access restrictions via a local program. Because exploitation is restricted to an attacker who already has local access to the machine, the vulnerable surface is not reachable from the public internet.

Google Chrome

before 157.0.8103.38

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's Chromoting feature could allow a local attacker to bypass access restrictions using a local program. While the severity is rated critical, the attack requires local access, making it unlikely to be exploited externally.

Local attackers could bypass restrictions.
High severity, but requires local access.
Confirm relevance and exposure of local access.

Attack Path

How an attacker could exploit the issue

An attacker with local access to a machine could exploit an authorization flaw within Chrome's Chromoting feature. This vulnerability allows a local program to bypass system access restrictions, potentially leading to unauthorized system access.

Local access required to initiate attack.
Bypasses system access restrictions.
Unauthorized system access.

Live Threat

Current exploitation, exposure, and threat context

Incorrect authorization in Chromoting, when supported by the advisory, could allow a local program to bypass system access restrictions.

Local system access restrictions could be bypassed.
A local program could exploit the vulnerability.
Unauthorized access to system resources may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability in Chromoting within Google Chrome impacts users with local access, suggesting that desktop or endpoint support teams, alongside application owners responsible for Chrome, should take the lead. The initial practical step is to inventory all endpoints running Chrome, identify those with Chromoting enabled or potentially accessible locally, and then assess business criticality before planning remediation during scheduled maintenance or coordinating with affected users for updates.

Desktop and application support teams.
Verify local access and Chromoting usage.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chromoting in Google Chrome?

Chromoting is the engine behind Chrome Remote Desktop, a feature that enables users to remotely access their computer or share their screen with others through the browser. It functions as a bridge between the local operating system and remote users, managing permissions to ensure only authorized individuals can control the machine or view its contents.

How does CVE-2026-121157 allow unauthorized access?

This vulnerability is classified as CWE-863, which refers to Incorrect Authorization. In the context of CVE-2026-121157, the flaw occurs when the Chromoting component fails to properly verify the credentials or permissions of a local program attempting to interact with it, allowing that program to bypass intended system access restrictions.

Do I need local access to trigger CVE-2026-121157?

Yes, an attacker must have local access to the target machine to exploit this flaw. The vulnerability specifically involves a local program bypassing authorization checks. Remote requests made over the internet or through typical network-based traffic would not trigger this specific authorization bypass.

Is my system at risk if it is not exposed to the internet?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited from the public internet. Because the attack requires a local program to bypass restrictions, the primary risk is limited to physical or authenticated local access to the device rather than remote network-based exploitation.

How should I respond to this Google Chrome vulnerability?

Your first step is to inventory your endpoints to identify where Chrome is installed and where Chromoting is actively used. Since the fix involves updating the software, prioritize scheduling these updates across your environment through standard maintenance cycles to ensure the latest version of Chrome is running.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.