CVE-2026-87525: Google Chrome Chromoting Out-of-Bounds Read

CVE-2026-87525 Overview

CVE-2026-87525 is an out-of-bounds read vulnerability [CWE-125] in the Chromoting component of Google Chrome on Windows. The flaw affects versions prior to 153.0.8010.36 and allows a local attacker to read memory outside the sandbox by executing a local program. Chromoting is the underlying technology that powers Chrome Remote Desktop functionality.

Google classifies the Chromium security severity as High, though the assigned CVSS score reflects the local attack vector, required user interaction, and limited confidentiality impact. Successful exploitation exposes memory contents that may include sensitive process data.

Critical Impact
A local attacker running a crafted program on a Windows host can read memory outside the Chromium sandbox boundary, potentially disclosing sensitive in-process data.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Chromium-based browsers incorporating the affected Chromoting code
Chrome Remote Desktop host installations on Windows

Discovery Timeline

2026-09-09 - CVE CVE-2026-87525 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87525

Vulnerability Analysis

The vulnerability resides in Chromoting, the component that implements Chrome Remote Desktop protocol handling on Windows. An out-of-bounds read occurs when the affected code accesses memory beyond the bounds of an allocated buffer during processing of remote desktop data or IPC messages.

Out-of-bounds reads in browser components typically expose adjacent heap memory. In this case, the disclosed memory sits outside the Chromium sandbox, which raises the risk profile because the attacker gains visibility into a more privileged process context than a compromised renderer would provide.

Exploitation requires local access and user interaction. The attacker must run a program on the target Windows system while a susceptible Chromoting process is active. Google has not published detailed exploitation mechanics. See the Chromium Issue Tracker #517336350 for restricted technical details.

Root Cause

The root cause is missing or insufficient bounds validation in a Chromoting code path that reads from a buffer. When the code processes attacker-influenced input, it dereferences memory beyond the intended allocation, returning bytes that were never meant to leave the process.

Attack Vector

The attack requires local code execution on the Windows host and user interaction, per the CVSS vector. A local program interacts with the Chromoting process, triggers the vulnerable read path, and receives memory contents that reside outside the Chromium sandbox. The scope is marked as changed because data crosses a security boundary.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87525

Indicators of Compromise

Unexpected local processes interacting with Chrome Remote Desktop host processes such as remoting_host.exe or remoting_desktop.exe
Crashes or abnormal termination of Chromoting processes recorded in Windows Event Log
Chrome versions on Windows endpoints reporting a build lower than 153.0.8010.36

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build older than 153.0.8010.36
Monitor for unsigned or unusual binaries opening handles to Chromoting IPC endpoints or named pipes
Correlate Chromoting process crash telemetry with parent process lineage to identify suspicious triggers

Monitoring Recommendations

Enable process creation and command-line auditing on Windows endpoints where Chrome Remote Desktop is installed
Alert on non-Google-signed processes performing cross-process reads against Chromoting binaries
Track Chrome auto-update status and surface hosts that fail to reach the patched build

How to Mitigate CVE-2026-87525

Immediate Actions Required

Update Google Chrome on Windows to version 153.0.8010.36 or later on all endpoints
Restart Chrome and Chrome Remote Desktop host services after applying the update to load the patched binaries
Audit which Windows endpoints have Chrome Remote Desktop enabled and disable it where unused

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update advisory. Upgrading to Chrome 153.0.8010.36 or later resolves the out-of-bounds read in Chromoting.

Workarounds

Disable Chrome Remote Desktop on Windows systems that do not require remote access
Restrict local user execution rights using AppLocker or Windows Defender Application Control to reduce the ability to run arbitrary local programs
Enforce Chrome enterprise policy to require the latest stable channel and block downgrades to vulnerable builds

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via Group Policy registry key
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f