CVE-2026-106294

Executive Summary

CVE-2026-106294 is an incomplete-cleanup vulnerability (CWE-459) in the Chromoting component of Google Chrome on macOS, affecting versions prior to 155.0.8059.39. A remote attacker can exploit improper resource cleanup to bypass system access restrictions through crafted network traffic. The vulnerability is rated Low severity by Chromium and carries no public exploit, PoC, or CISA KEV status at this time.

Technical Analysis

The vulnerability resides in Chromoting, Google's remote desktop infrastructure that underpins Chrome Remote Desktop. Chromoting operates as a cross-platform remoting stack, and on macOS it must interface with native system facilities such as screen capture permissions, accessibility APIs, and sandbox entitlement boundaries. The CNA description identifies the flaw as "incomplete cleanup," mapped to CWE-459, which denotes a failure to properly release, remove, or invalidate resources after use.

Incomplete cleanup flaws manifest when a component fails to tear down state that should have been discarded — examples include stale session artifacts, leftover temporary files, retained privilege tokens, or unclosed handles. Because the cleanup is incomplete, residual state can persist beyond the intended lifetime of the operation. In the Chromoting context on macOS, such residue can undermine the system access restrictions that macOS enforces on remoting sessions, effectively allowing a bypass of those controls.

The attack vector is network-based and remote. The description states the attacker uses "crafted network traffic," indicating the flaw is reachable through the remoting protocol path rather than requiring local code execution. The impact is classified as a system access restriction bypass, meaning the attacker gains capabilities that should have been blocked by macOS-level controls rather than direct memory corruption or code execution. No specific functions, endpoints, or parameters are disclosed in the available description; the precise cleanup mechanism, affected class, and protocol message format are not detailed in the CNA/NVD data. Analysis beyond the vulnerable component and flaw class would require the upstream Chromium patch, which is not available in tracked sources.

Chromium assigned this a Low security severity. That rating reflects a constrained impact — typically a bypass requiring specific conditions, user interaction, or limited privilege gain — rather than a broadly exploitable remote code execution flaw. The attack complexity is likely elevated because triggering the cleanup defect requires the attacker to reach and manipulate the remoting session state.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (CWE-459, incomplete cleanup) and the stated impact (bypass of system access restrictions via crafted network traffic). Specific implementation details are not available.

1. Reconnaissance/target identification. An attacker identifies a macOS host running a vulnerable Chrome build (< 155.0.8059.39) with Chromoting/Chrome Remote Desktop enabled. Discovery may leverage Shodan or similar exposure scanning for remoting endpoints, or social/network positioning that lets the attacker send traffic to the Chromoting service.

2. Triggering the flaw class. The attacker crafts network traffic directed at the Chromoting component. The malformed or specially sequenced traffic causes the cleanup routine to complete only partially, leaving residual state (e.g., an unremoved session artifact or unrevoked access context) that should have been invalidated.

3. Payload/execution method at the vulnerability-class level. Because this is an incomplete-cleanup weakness rather than injection or memory corruption, "execution" consists of the attacker leveraging the leftover state to operate within a context where macOS system access restrictions would normally apply. The crafted traffic itself is the delivery mechanism; the bypass occurs as a consequence of the uncleaned state rather than through a separate exploit primitive. No specific packet format or protocol message is described in the available data.

4. Post-exploitation impact. Successful exploitation allows the attacker to bypass system access restrictions on the target macOS host. The precise scope of what becomes accessible is not disclosed; the severity rating (Low) and the "system access restriction bypass" phrasing suggest a bounded, conditional impact rather than full host compromise. No persistence, lateral movement, or credential-theft behavior is described.

Impact Assessment

The primary impact is an integrity/authorization bypass of macOS system access restrictions rather than confidentiality or availability loss. No CVSS score or vector is provided by NVD, so subscore discussion is based on the qualitative description and Chromium's Low severity rating. The blast radius is limited to macOS endpoints running vulnerable Chrome with Chromoting in use; Windows and Linux Chrome builds are not described as affected. Enterprises using Chrome Remote Desktop for IT support or remote administration on macOS should treat exposed remoting endpoints as the affected surface. The EPSS score has not been published by FIRST.org, so no probabilistic exploitation forecast is available. No CISA KEV listing and no in-the-wild exploitation evidence currently exist.

Detection Guidance

Sigma Rule

title: Potential Chromoting Incomplete Cleanup Exploitation (CVE-2026-106294)
id: 8f4c1a2e-7b3d-4c9a-9e21-cve2026106294
status: experimental
description: Detects anomalous Chromoting/Chrome Remote Desktop process behavior on macOS indicative of access-restriction bypass attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106294
author: valtersit.com
date: 2026/01/01
logsource:
  product: macos
  category: process_creation
detection:
  selection_proc:
    Image|endswith:
      - '/Google Chrome'
      - '/Google Chrome Helper'
  selection_args:
    CommandLine|contains:
      - 'remoting'
      - 'chromoting'
  condition: selection_proc and selection_args
falsepositives:
  - Legitimate Chrome Remote Desktop usage
level: low
tags:
  - attack.t1190
  - cve.2026.106294

YARA Rule

rule CVE_2026_106294_Chromoting_Incomplete_Cleanup
{
    meta:
        description = "Detects Chrome for macOS Chromoting binaries potentially affected by CVE-2026-106294"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106294"
        date = "2026-01-01"
        severity = "low"
    strings:
        $chromoting = "chromoting" ascii nocase
        $remoting   = "remoting" ascii nocase
        $mac_ver    = "155.0.8059" ascii
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0xFEEDFACE or uint32(0) == 0xFEEDFACF)
        and $chromoting
        and $remoting
        and not $mac_ver
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106294 Possible Chromoting Access Restriction Bypass Attempt"; flow:to_server,established; content:"chromoting"; nocase; content:"remoting"; nocase; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-106294; sid:2026106294; rev:1;)

Elastic Detection

process where process.name in ("Google Chrome", "Google Chrome Helper") and
process.command_line : ("*remoting*" or "*chromoting*") and
process.parent.name : ("launchd" or "Google Chrome")

Splunk SPL Query

index=endpoint (process_name="Google Chrome" OR process_name="Google Chrome Helper")
(process_command_line="*remoting*" OR process_command_line="*chromoting*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_command_line
| where count > 3

Wazuh OSSEC Rule

<group name="chrome,cve-2026-106294,">
  <rule id="106294" level="5">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">Google Chrome</field>
    <match>remoting|chromoting</match>
    <description>CVE-2026-106294: Possible Chromoting incomplete cleanup / access restriction bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Disable or restrict Chrome Remote Desktop / Chromoting on macOS endpoints that do not require it. Where remoting must remain enabled, restrict inbound remoting traffic to trusted management networks and enforce strong host authentication. Reduce reliance on macOS system access grants for remoting hosts.

2. Patch/upgrade steps. Upgrade Google Chrome on macOS to version 155.0.8059.39 or later, which the advisory identifies as the fixed release. Verify the build number in chrome://version after updating. Because no patch artifacts are tracked in available sources, confirm the fix via Google's official Chrome release channels and apply through managed update policy.

3. Long-term hardening. Enforce automatic Chrome updates via enterprise policy, inventory remoting endpoints, apply least-privilege macOS entitlements to remoting hosts, and monitor for anomalous Chromoting session behavior. Validate that system access grants are revoked at session end.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106294
• Chromium security severity guidance (Low) — referenced in NVD description
• Google Chrome release notes for version 155.0.8059.39 (macOS)
• CISA KEV catalog: not listed (no known exploited vulnerabilities entry)
• FIRST.org EPSS: not yet scored

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-106294 at this time.