CVE-2026-14060: Google Chrome Privilege Escalation Flaw

CVE-2026-14060 Overview

CVE-2026-14060 is an input validation vulnerability [CWE-20] in the Chromoting component of Google Chrome on Windows. Chromoting is the underlying framework for Chrome Remote Desktop. The flaw affects Chrome versions prior to 150.0.7871.47 on Windows. A local attacker can exploit the vulnerability by delivering a malicious file to a targeted user. Successful exploitation results in privilege escalation on the affected host. Chromium classifies the security severity as Low, while the NVD CVSS 3.1 base score is 7.8 (High) due to the potential impact on confidentiality, integrity, and availability.

Critical Impact
A local attacker who convinces a user to open a crafted file can escalate privileges through the Chromoting component in Chrome on Windows.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Chromoting component (Chrome Remote Desktop host)
Windows-based Chromium derivatives incorporating the same Chromoting code

Discovery Timeline

2026-06-30 - CVE-2026-14060 published to the National Vulnerability Database
2026-07-02 - NVD entry last modified

Technical Details for CVE-2026-14060

Vulnerability Analysis

The vulnerability resides in Chromoting, the host-side implementation that supports Chrome Remote Desktop on Windows. Chromoting fails to sufficiently validate untrusted input contained in a file supplied to the component. When Chromoting processes the malicious file, the missing validation allows an attacker-controlled path or content to influence a privileged operation. The result is a local privilege escalation on the Windows host running the vulnerable Chrome build. The attack requires user interaction, as indicated by the CVSS vector, but does not require prior authentication to Chrome.

Root Cause

The root cause is improper input validation [CWE-20] in the Chromoting file-handling path. Chromoting trusts attributes of an incoming file without enforcing constraints that would prevent an unprivileged caller from directing privileged Chromoting operations. Because part of Chromoting runs with elevated context on Windows, unvalidated input crosses a trust boundary and enables the attacker to gain higher privileges than the invoking user.

Attack Vector

Exploitation is local and requires the victim to interact with a malicious file. An attacker with the ability to place a file on the system, or to persuade a user to open one, triggers the vulnerable Chromoting code path. No network access to the target is required. See the Google Chrome Desktop Update and the Chromium Issue Tracker Note for vendor references. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-14060

Indicators of Compromise

Chrome installations on Windows reporting a version earlier than 150.0.7871.47
Unexpected Chromoting host processes (remoting_host.exe) spawning child processes with elevated tokens
Creation or modification of files in Chromoting working directories by non-standard users
Chrome Remote Desktop host events referencing unfamiliar file paths supplied as configuration input

Detection Strategies

Inventory Chrome versions across Windows endpoints and flag hosts below 150.0.7871.47
Alert on Chromoting host processes performing file operations outside their expected profile directories
Correlate user-initiated file opens with subsequent privilege-elevation events involving Chromoting binaries

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging for Chromoting binaries
Monitor integrity-level transitions where a medium-integrity process spawns high-integrity children under Chrome components
Ingest Chrome update telemetry into the SIEM to track patch adoption across the fleet

How to Mitigate CVE-2026-14060

Immediate Actions Required

Update Google Chrome on Windows to version 150.0.7871.47 or later on all endpoints
Restart Chrome after the update to ensure the Chromoting host component is reloaded
Restrict who can deliver files to endpoints via email, shared drives, and removable media until patching completes
Verify enterprise Chrome deployment policies are pulling from the stable channel

Patch Information

Google addressed the vulnerability in the Chrome stable channel release announced in the Google Chrome Desktop Update. Windows users must install Chrome 150.0.7871.47 or later. Managed environments should push the update through Chrome Browser Cloud Management, Group Policy, or the organization's standard software distribution tooling. Confirm remediation by checking chrome://version on representative hosts.

Workarounds

Disable or uninstall Chrome Remote Desktop host software on systems that do not require it
Apply application allow-listing to prevent execution of untrusted files that could target the Chromoting handler
Enforce standard user accounts and User Account Control (UAC) prompts to limit the impact of local privilege escalation

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force a Chrome update check on a managed endpoint
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler