CVE-2026-17877: Google Chrome Privilege Escalation Flaw

CVE-2026-17877 Overview

CVE-2026-17877 is a privilege escalation vulnerability in the Chromoting component of Google Chrome on Linux. Chromoting is the internal name for Chrome Remote Desktop functionality. The flaw affects Chrome versions prior to 151.0.7922.72 and stems from an inappropriate implementation that processes network traffic without sufficient validation.

An attacker on an adjacent network can send malicious traffic to a vulnerable host and achieve operating system-level privilege escalation. The issue is categorized under CWE-269: Improper Privilege Management. Google classifies the Chromium severity as Medium, while the NVD assigns a higher score based on the impact to confidentiality, integrity, and availability.

Critical Impact
A local attacker with adjacent network access can escalate to OS-level privileges on Linux hosts running vulnerable versions of Chromoting.

Affected Products

Google Chrome on Linux prior to 151.0.7922.72
Chrome Remote Desktop (Chromoting) component on Linux
Downstream Chromium-based distributions bundling the affected Chromoting code

Discovery Timeline

2026-07-30 - CVE-2026-17877 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17877

Vulnerability Analysis

The vulnerability resides in the Chromoting subsystem, which handles Chrome Remote Desktop sessions on Linux. Chromoting includes a host service that runs with elevated privileges to broker remote desktop sessions and manage OS-level resources such as display servers, input devices, and session lifecycle.

The root category is improper privilege management ([CWE-269]). An implementation defect in how Chromoting processes network-delivered inputs allows a local, adjacent-network attacker to influence privileged code paths. The result is escalation from a lower-privilege context to OS-level privileges on the host. Successful exploitation grants full read, write, and availability impact on the target system.

Root Cause

Google attributes the issue to an "inappropriate implementation" in Chromoting rather than a memory-corruption bug. This class of defect typically involves missing authorization checks, trust-boundary violations, or incorrect assumptions about the origin or content of messages arriving over the network. The Chromoting host trusts input that should be validated before it reaches privileged operations, enabling an attacker to steer the privileged component into performing actions on their behalf.

Attack Vector

The attack vector is Adjacent Network. The attacker must be able to send crafted network traffic reachable by the Chromoting service on the victim's Linux host, for example on the same broadcast segment, VLAN, or virtual network. User interaction is not required, and the attacker does not need prior authentication on the target. Attack complexity is High, reflecting timing or configuration conditions that must be satisfied for reliable exploitation. Refer to the Chromium Issue Tracker Entry and the Google Blog Chrome Update for vendor detail.

No public proof-of-concept code is available at the time of publication, and no verified exploit examples exist for inclusion here.

Detection Methods for CVE-2026-17877

Indicators of Compromise

Unexpected chrome-remote-desktop host processes running with elevated privileges on Linux endpoints.
New or modified files under ~/.config/chrome-remote-desktop/ or /opt/google/chrome-remote-desktop/ that do not correspond to scheduled updates.
Inbound connections to Chromoting host ports from unusual adjacent-network sources, particularly outside expected remote-desktop workflows.
Privilege transitions in audit logs where a session originating from the Chromoting service spawns root-owned children.

Detection Strategies

Inventory Linux endpoints and identify Chrome installations below version 151.0.7922.72 using package-manager queries or endpoint telemetry.
Alert on child processes spawned by the Chromoting host that execute shells, package managers, or system binaries such as sudo, su, bash, or systemctl.
Correlate network flows targeting Chromoting listeners with subsequent local privilege transitions on the same host.

Monitoring Recommendations

Enable Linux auditd rules for execve events under the Chromoting service account and forward them to a centralized log platform.
Monitor for unauthorized enablement of the Chrome Remote Desktop host service on systems that do not require it.
Track outbound and adjacent-network traffic to Chromoting ports and flag deviations from baseline remote-desktop usage.

How to Mitigate CVE-2026-17877

Immediate Actions Required

Update Google Chrome on all Linux hosts to version 151.0.7922.72 or later.
Restart the Chromoting host service after patching so the new binaries are loaded into memory.
Audit endpoints where Chrome Remote Desktop is installed but not actively used and remove the component where it is not required.
Restrict adjacent-network reachability to Chromoting listeners using host-based firewalls or network segmentation.

Patch Information

Google released the fix in the Stable channel update announced in the Google Blog Chrome Update. Linux users must upgrade to Chrome 151.0.7922.72 or later. Distribution-packaged builds and Chromium downstreams should be updated as soon as vendor packages incorporating the fix become available. Additional engineering detail is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable or uninstall the Chrome Remote Desktop host service on Linux systems that do not require remote-desktop functionality.
Enforce network segmentation so that Chromoting hosts are not reachable from untrusted adjacent-network segments.
Apply least-privilege configuration to the Chromoting service account and monitor for unexpected privilege transitions until patching is complete.

bash

# Configuration example: disable Chrome Remote Desktop host service on Linux
sudo systemctl stop chrome-remote-desktop@$(whoami).service
sudo systemctl disable chrome-remote-desktop@$(whoami).service
sudo apt-get remove --purge chrome-remote-desktop

# Verify installed Chrome version meets the fixed release
google-chrome --version