Description

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T00:18:28.337Z",
  "pubdate": "2026-09-02T00:18:28.337Z",
  "executiveSummary": "A security vulnerability categorized as incorrect authorization exists within the Chromoting component of Google Chrome on Windows.\nThe flaw permits a local attacker to achieve arbitrary code execution outside the browser's security sandbox.\nThis vulnerability affects versions prior to 152.0.7977.75.\nThe primary risk involves a privilege escalation scenario where an attacker with local access to the host machine can leverage the Chromoting service to bypass sandbox constraints, potentially leading to full system compromise.\nExploitation requires the attacker to already possess local access to the Windows environment to interact with the vulnerable Chromoting program.\nDue to the capability of escaping the sandbox and executing arbitrary code, the vulnerability is classified as Medium severity by the Chromium security team.",
  "technicalDetails": "The vulnerability resides in the authorization logic of the Chromoting component within Google Chrome for Windows. Chromoting, the remote desktop functionality integrated into Chromium-based browsers, relies on specific inter-process communication (IPC) mechanisms and local host services to facilitate connectivity.\nThe root cause is an improper authorization check during the interaction between a local client application and the Chromoting service. Specifically, the service fails to sufficiently validate the origin or the security context of the requests initiated by a local program.\nUnder normal operating conditions, the Chromoting process runs within a constrained sandbox environment designed to limit the impact of potential vulnerabilities. However, due to this authorization flaw, a local attacker can manipulate the communication channel to inject malicious payloads into the service.\nThe attack flow proceeds as follows: An attacker with local access creates or executes a malicious local program. This program crafts a request directed at the vulnerable Chromoting interface. Because the interface fails to properly verify the caller's authorization or integrity, it accepts the request despite the unauthorized source.\nOnce the request is accepted, the attacker is able to force the Chromoting service to execute arbitrary code with the service's elevated or inherited permissions. By successfully bypassing the sandbox, the malicious payload gains access to system-level resources or user-space processes that are otherwise protected from standard web-based exploits.\nThis vulnerability is distinct from remote execution attacks, as it necessitates local presence on the host machine. The exploitation essentially transforms a local application into an interface for bypassing the browser's primary security boundary. The post-exploitation impact includes the ability for the attacker to maintain persistence, escalate privileges, or access sensitive data residing on the host machine, depending on the context in which the Chromoting service operates.\nThe issue is specific to the Windows implementation of Chromoting in versions prior to 152.0.7977.75, where the interface logic lacked the necessary hardening against unauthorized local process calls."
}