CVE-2026-106183

Executive Summary

CVE-2026-106183 is a missing authorization vulnerability (CWE-862) in the Chromoting component of Google Chrome on Windows, affecting versions prior to 155.0.8059.39. A remote, unauthenticated attacker can exploit this flaw by sending crafted network traffic, potentially obtaining sensitive information from the targeted system. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium severity) with high confidentiality impact but no integrity or availability impact. No public exploit or PoC is currently available, and the issue has not been added to CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in Chromoting, which is the remote desktop protocol and implementation underlying Chrome Remote Desktop. The core issue is categorized as CWE-862: Missing Authorization. This means that a specific action or resource accessible through the Chromoting service lacks an authorization check, allowing an attacker to access functionality or data that should be restricted. The NVD description states that the flaw is triggered via crafted network traffic, indicating that the attack surface is the network-facing interface of the Chromoting component. Because the vulnerability is on Windows, the Chromoting host service—which typically listens for incoming connections—is the most likely attack vector. However, the exact nature of the missing authorization check, the specific protocol messages involved, or the precise code path is not detailed in the available intelligence. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates that exploitation is network-accessible, requires high attack complexity (likely because the attacker must craft specific traffic that passes some initial validation or interacts with a race condition/state), requires no privileges or user interaction, and results in a high confidentiality impact only. The "crafted network traffic" phrasing suggests the attacker must send specially formed packets to the Chromoting service to bypass or skip an authorization step, thereby leaking sensitive information such as session tokens, remote desktop contents, or host system data.

Exploitation Scenarios

No public PoC or exploit code is available. The following attack chain is inferred strictly from the vulnerability class (missing authorization) and the sparse NVD description. It does not rely on any invented function names or protocol specifics.

1. Reconnaissance / Target Identification: An attacker identifies a Windows host running a vulnerable version of Google Chrome (prior to 155.0.8059.39) with the Chromoting component enabled and reachable over the network. This could be a workstation or server that has Chrome Remote Desktop host configured. Scanning for open ports associated with Chrome Remote Desktop (e.g., TCP 443 or custom-configured ports) could reveal potential targets. The attacker does not need credentials at this stage.

2. Triggering the Missing Authorization Flaw: The attacker crafts network traffic specifically designed to interact with the Chromoting service in a way that bypasses an expected authorization check. Because the flaw is "missing authorization," the attacker likely sends a request that the service processes without verifying that the sender has the necessary permissions. The high attack complexity (AC:H) suggests that the crafted traffic must meet specific conditions—perhaps a particular sequence, timing, or message format—to reach the vulnerable code path. The description does not specify the exact message structure or endpoint.

3. Payload / Execution Method: At the vulnerability-class level, the attacker sends a network request that should require authorization but does not receive it. The service then returns or exposes sensitive information in response. No specific payload, shellcode, or file path is indicated in the available data. The attack is purely network-based and does not require user interaction (UI:N).

4. Post-Exploitation Impact: Successful exploitation allows the attacker to obtain sensitive information (C:H). The exact nature of the information is not specified, but in the context of a remote desktop service, it could include screen contents, clipboard data, session identifiers, or authentication tokens. There is no impact on integrity or availability (I:N/A:N), and the scope is unchanged (S:U). The attacker gains only confidentiality, not control over the system.

Impact Assessment

The CVSS v3.1 base score is 5.9, which is Medium severity. The subscores are:

• Confidentiality (C:H): High impact. The attacker can read sensitive information, potentially including remote desktop session data or host system details.
• Integrity (I:N) and Availability (A:N): No impact. The attacker cannot modify or disrupt the service.
• Attack Vector (AV:N): Network exploitable. The attacker can launch the attack remotely.
• Attack Complexity (AC:H): High. Exploitation requires conditions beyond the attacker's control (e.g., specific traffic patterns, timing, or state) or significant reconnaissance.
• Privileges Required (PR:N): None. The attacker does not need authentication or authorization.
• User Interaction (UI:N): None. The victim does not need to open a file or click a link.
• Scope (S:U): Unchanged. The impact is confined to the Chromoting component.

Business impact: Organizations using Chrome Remote Desktop on Windows for remote administration or user access could face unauthorized information disclosure. If the leaked data includes session tokens or screen contents, it may lead to further lateral movement or privacy breaches. The blast radius is limited to systems running the vulnerable Chromoting service, but because Chrome is widely deployed, the potential number of exposed endpoints is large. However, the high attack complexity and lack of public exploit reduce the immediate risk. No evidence of active exploitation or CISA KEV listing.

Detection Guidance

Sigma Rule

title: Potential Chromoting Missing Authorization Exploitation (CVE-2026-106183)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic to Chromoting service that may indicate exploitation of missing authorization vulnerability.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106183
author: Threat Intelligence
date: 2026-05-12
tags:
  - attack.t1190
  - cve.2026.106183
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 5222
      - 5223
    Initiated: 'true'
    Image|endswith:
      - '\remoting_host.exe'
      - '\chrome.exe'
  condition: selection
falsepositives:
  - Legitimate Chrome Remote Desktop connections
level: medium

YARA Rule

rule CVE_2026_106183_Chromoting_Missing_Auth
{
    meta:
        description = "Detects potential exploitation attempts targeting Chromoting missing authorization (CVE-2026-106183)"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106183"
        severity = "medium"

    strings:
        $chromoting = "chromoting" nocase
        $remoting = "remoting_host" nocase
        $remote_desktop = "Chrome Remote Desktop" nocase
        $auth_bypass = "authorization" nocase
        $crafted = "crafted network traffic" nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and
        (2 of ($chromoting, $remoting, $remote_desktop) or
         any of ($auth_bypass, $crafted))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-106183 - Chromoting Missing Authorization Attempt";
    flow:to_server,established;
    content:"|16 03|";
    depth:2;
    offset:0;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2026-106183;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-106183;
    metadata:affected_product Google_Chrome, vulnerability_class CWE-862;
)

Elastic Detection

network where
    process.name in ("chrome.exe", "remoting_host.exe") and
    network.transport == "tcp" and
    network.direction == "outbound" and
    destination.port in (443, 5222, 5223) and
    event.category == "network" and
    not process.parent.name == "services.exe"

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=pan:traffic OR sourcetype=zeek:conn
| search dest_port IN (443, 5222, 5223) AND (process_name="remoting_host.exe" OR process_name="chrome.exe")
| stats count by src_ip, dest_ip, dest_port, process_name
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="chromoting,cve-2026-106183,">
  <rule id="100200" level="10">
    <if_sid>1002</if_sid>
    <field name="win.eventdata.destinationPort">443|5222|5223</field>
    <field name="win.eventdata.image">remoting_host\.exe|chrome\.exe</field>
    <description>CVE-2026-106183: Potential Chromoting missing authorization exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106183,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the Chromoting component (Chrome Remote Desktop host) on Windows systems where it is not required. This removes the attack surface entirely.
   • If Chromoting is required, restrict network access to the service using host-based firewalls or network segmentation. Allow connections only from trusted management IP addresses.
   • Monitor for anomalous traffic to and from Chrome Remote Desktop ports (e.g., TCP 443, 5222, 5223) and inspect for crafted packets that deviate from normal protocol behavior.
   • Implement application allowlisting to prevent execution of unauthorized processes that could interact with the Chromoting service.

2. Patch / Upgrade Steps:

   • No official patch is currently available according to tracked sources. The CNA advisory indicates that Chrome 155.0.8059.39 (Windows) is the fixed version. Administrators should upgrade to this version or later as soon as Google releases it or as soon as the stable channel updates. Until then, treat all versions below 155.0.8059.39 as vulnerable.
   • Subscribe to Google Chrome release notes and the Chromium security blog for the official patch announcement.
   • Verify the installed Chrome version via chrome://version or by checking the executable file version.

3. Long-term Hardening:

   • Enforce a policy of least functionality: disable remote desktop services unless explicitly required for business operations.
   • Require multi-factor authentication for all remote desktop access, even if the underlying protocol has an authorization flaw.
   • Regularly audit and update Chrome and all Google components to the latest stable release.
   • Conduct periodic vulnerability scans focusing on remote access services and ensure that any network-exposed service has proper authorization checks.
   • Implement network detection and response (NDR) to identify anomalous traffic patterns that could indicate exploitation of missing authorization flaws.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106183
• Google Chrome Release Notes (stable channel): https://chromereleases.googleblog.com/
• Chromium Security Severity Guidelines: https://www.chromium.org/developers/severity-guidelines
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing.