CVE-2026-78892: Google Chrome Chromoting Auth Bypass Flaw

CVE-2026-78892 Overview

CVE-2026-78892 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Windows. Chromoting is the underlying technology that powers Chrome Remote Desktop. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a local attacker to bypass system access restrictions through a local program. Google classifies the Chromium security severity as Medium. The weakness is categorized under [CWE-863: Incorrect Authorization].

Critical Impact
A local attacker executing code on a Windows host can bypass system access restrictions enforced by the Chromoting component, potentially expanding the attacker's control over the endpoint.

Affected Products

Google Chrome on Windows prior to 152.0.7977.65
Chromium-based browsers on Windows that ship the vulnerable Chromoting component
Chrome Remote Desktop deployments relying on the affected Chrome versions

Discovery Timeline

2026-08-25 - CVE-2026-78892 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78892

Vulnerability Analysis

The vulnerability resides in the Chromoting subsystem of Google Chrome, the component responsible for remote desktop functionality. According to Google's advisory, an authorization check fails to correctly enforce system access restrictions when invoked from a local program. A local attacker can leverage this gap to perform actions the browser's security model should otherwise deny.

The issue maps to [CWE-863: Incorrect Authorization], indicating that the code performs an authorization check but does so incorrectly. The result is that a lower-privileged local process can interact with Chromoting in a way that yields access beyond its intended boundary. Because the attack requires local access, remote exploitation over the network is not in scope.

Google assigned this issue a Chromium severity of Medium. The EPSS probability at publication was 0.109%, reflecting a low likelihood of active exploitation.

Root Cause

The root cause is an authorization decision within Chromoting that does not properly validate the caller's rights before granting access to protected functionality. Details of the specific code path remain restricted, and the Chromium bug tracker entry Chromium Issue #518053893 is view-restricted pending broader user updates.

Attack Vector

Exploitation requires the attacker to already have local code execution on the Windows host. A local program interacts with Chromoting and triggers the flawed authorization path to bypass system access restrictions. No network vector and no user interaction beyond running the local program are indicated in the advisory.

No public proof-of-concept exploit is available. See the Google Chrome Stable Update for the vendor's release notes.

Detection Methods for CVE-2026-78892

Indicators of Compromise

Unexpected remoting_host.exe or Chromoting host processes launching on endpoints that do not use Chrome Remote Desktop.
Local processes spawning Chrome subprocesses with unusual command-line arguments referencing remoting components.
Chrome installations on Windows reporting versions below 152.0.7977.65 in software inventory.

Detection Strategies

Inventory all Windows endpoints and flag Chrome builds older than 152.0.7977.65 for immediate patch prioritization.
Monitor for local inter-process communication with Chromoting host services from processes that are not part of the standard Chrome install path.
Correlate execution of unsigned or user-writable binaries with subsequent Chromoting activity to surface bypass attempts.

Monitoring Recommendations

Enable process creation and command-line auditing on Windows through Event ID 4688 and Sysmon Event ID 1 for Chrome and Chromoting binaries.
Track privilege changes and access token manipulations that follow interactions with Chromoting components.
Feed browser and endpoint telemetry into a centralized data lake for retrospective hunting once additional exploit details become public.

How to Mitigate CVE-2026-78892

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later on every managed and unmanaged endpoint.
Restart Chrome after the update completes so the patched Chromoting component loads into memory.
Verify enterprise deployment tools have pushed the update to remote and offline devices once they reconnect.

Patch Information

Google addressed CVE-2026-78892 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Windows users should confirm the browser reports version 152.0.7977.65 or higher under chrome://settings/help. Chromium-based browser vendors that consume upstream Chromium code should ship the corresponding fix in their next stable release.

Workarounds

Restrict local user privileges on Windows endpoints to limit the ability of untrusted programs to interact with Chromoting.
Disable or uninstall Chrome Remote Desktop where the feature is not required for business operations.
Apply application control policies to block unauthorized executables from running on endpoints where Chrome is installed.

bash

# Configuration example: verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon" /v version