CVE-2026-84334 Overview
CVE-2026-84334 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Windows. Chromoting powers Chrome Remote Desktop functionality. Versions prior to 152.0.7977.75 fail to enforce authorization checks correctly, allowing a local attacker to execute arbitrary code outside the Chrome sandbox by leveraging a local program.
The issue is tracked under CWE-863: Incorrect Authorization and rated Medium by the Chromium security team. NVD assigns it a higher score because sandbox escapes carry elevated impact on confidentiality, integrity, and availability.
Critical Impact
A local attacker can escape the Chrome sandbox and execute arbitrary code on Windows systems running Chrome versions prior to 152.0.7977.75.
Affected Products
- Google Chrome on Windows prior to 152.0.7977.75
- Chromoting (Chrome Remote Desktop) component
- Chromium-based builds incorporating the vulnerable Chromoting code
Discovery Timeline
- 2026-09-02 - CVE-2026-84334 published to NVD
- 2026-09-03 - Last updated in NVD database
- Vendor advisory: Chrome Stable Channel Update
- Chromium tracker: Chromium Issue #517798926
Technical Details for CVE-2026-84334
Vulnerability Analysis
The flaw resides in the Chromoting subsystem, which brokers remote desktop sessions in Chrome. Incorrect authorization logic permits a local program to interact with privileged Chromoting interfaces without satisfying the required permission checks. Successful exploitation lets attacker-controlled code run in a context outside the renderer sandbox, expanding the blast radius to the host operating system.
Because the scope is changed and the impact spans confidentiality, integrity, and availability, exploitation results in a full sandbox escape rather than a contained renderer compromise. Exploitation requires local access and elevated attack complexity, but no privileges and no user interaction once the attacker can run a local program.
Root Cause
The root cause is an authorization decision in Chromoting that does not correctly validate the identity or entitlement of the calling process. Under [CWE-863], the code path performs an authorization check but the check is incorrect, allowing unauthorized callers to invoke privileged actions.
Attack Vector
An attacker who can execute a local program on the target Windows host invokes the vulnerable Chromoting interface. The interface accepts the request due to the flawed authorization check and performs actions that would normally be gated to trusted callers. This lets the attacker break out of the Chrome sandbox and run arbitrary code with the privileges of the affected Chromoting process.
No verified public exploit code is available. See the Chromium Issue #517798926 tracker for restricted technical details.
Detection Methods for CVE-2026-84334
Indicators of Compromise
- Unexpected child processes spawned by chrome.exe or the Chrome Remote Host service (remoting_host.exe) that do not match normal remote desktop workflows.
- Local processes issuing IPC calls to Chromoting endpoints without an active, user-initiated remote session.
- Chrome Remote Desktop host binaries writing to or executing content from user-writable directories.
Detection Strategies
- Inventory Chrome installations and flag any Windows host running a version below 152.0.7977.75.
- Alert on process lineage anomalies where Chromoting components spawn shells, script interpreters, or LOLBins.
- Correlate local logon events with subsequent Chromoting IPC activity to identify unauthorized invocation patterns.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints.
- Ingest Sysmon process, image load, and IPC events into centralized logging for retrospective hunting.
- Track Chrome update compliance across the fleet and alert on drift from patched builds.
How to Mitigate CVE-2026-84334
Immediate Actions Required
- Update Google Chrome on Windows to 152.0.7977.75 or later on every affected endpoint.
- Restart the browser after updating so the new binaries and Chromoting host components load.
- Audit which endpoints have Chrome Remote Desktop enabled and disable it where it is not required.
Patch Information
Google addressed CVE-2026-84334 in Chrome Stable channel version 152.0.7977.75 for Windows. Deployment details are in the Chrome Stable Channel Update. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution channel.
Workarounds
- Disable Chrome Remote Desktop and remove the Chromoting host component on systems that do not need remote access.
- Restrict local logon rights on sensitive workstations to reduce the population of users who can stage a local program.
- Apply application control policies to block untrusted binaries from executing in user-writable paths.
# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Force Chrome update via enterprise policy (PowerShell)
Start-Process -FilePath "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" -ArgumentList "/ua /installsource scheduler"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
