CVE-2026-87554: Google Chrome Race Condition Vulnerability

CVE-2026-87554 Overview

CVE-2026-87554 is a race condition vulnerability in the Chromoting component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a local attacker to execute arbitrary code outside the browser sandbox by leveraging a local program. Chromoting is the underlying framework that supports Chrome Remote Desktop functionality. The weakness is classified under CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition. Google's Chromium team rated the security severity as High.

Critical Impact
A local attacker exploiting this race condition can escape the Chrome sandbox and execute arbitrary code on the host Windows system, compromising confidentiality, integrity, and availability.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows hosts running the Chromoting component
Chrome Remote Desktop deployments dependent on the vulnerable Chromoting code

Discovery Timeline

2026-09-09 - CVE-2026-87554 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87554

Vulnerability Analysis

The vulnerability resides in the Chromoting subsystem, which supports Chrome Remote Desktop features on Windows. A race condition (CWE-367) permits an attacker with local access to interfere with the sequence between a security check and a subsequent operation. By winning the race window, a local program can influence the state that Chromoting relies on to enforce sandbox boundaries. Successful exploitation results in arbitrary code execution outside the Chrome sandbox context. The scope is Changed, meaning the compromise extends beyond the vulnerable Chrome process to affect the broader Windows environment.

Root Cause

The root cause is a Time-of-Check Time-of-Use flaw in Chromoting's handling of shared resources or state on Windows. Between the moment Chromoting validates a condition and the moment it acts on that condition, a concurrent local process can modify the underlying object. This atomicity violation lets the attacker substitute attacker-controlled data or references after validation succeeds. See the Chromium Issue Tracker entry for further technical context.

Attack Vector

Exploitation requires local access to the Windows machine running the vulnerable Chrome build. The attacker executes a local program that races Chromoting operations to hit the narrow timing window. Attack complexity is High because the attacker must reliably win the race between validation and use. No user interaction and no prior authentication are needed for the local program to attempt the race. Successful exploitation yields code execution outside the Chrome sandbox, breaking a core browser security boundary.

No public proof-of-concept exploit is available at the time of publication. Refer to the Google Chrome Stable Update advisory for vendor details.

Detection Methods for CVE-2026-87554

Indicators of Compromise

Unexpected child processes spawned from chrome.exe or Chromoting-related binaries such as remoting_host.exe running with parent-child relationships inconsistent with normal Chrome Remote Desktop use.
New or modified executables and DLLs in Chrome or Chrome Remote Desktop install paths that do not correspond to a legitimate update.
Local processes performing high-frequency access or handle operations against Chromoting IPC endpoints or shared objects, indicative of race-window probing.

Detection Strategies

Inventory endpoints for Chrome versions below 153.0.8010.36 on Windows and flag any host still running an affected build.
Hunt for anomalous process lineage where Chromoting components spawn interactive shells, script interpreters (powershell.exe, cmd.exe, wscript.exe), or LOLBins.
Correlate local logon sessions with rapid, repeated interactions against Chromoting objects to identify potential race exploitation attempts.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on hosts running Chrome Remote Desktop.
Ingest Sysmon Event IDs 1 (process create), 7 (image load), and 10 (process access) into a centralized analytics platform for lineage-based detections.
Track integrity level transitions where a low-integrity Chrome renderer or sandboxed helper is followed by medium- or high-integrity process activity on the same host.

How to Mitigate CVE-2026-87554

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later using the vendor-provided Stable channel release.
Restart Chrome after the update completes so the patched Chromoting components are loaded into memory.
Audit and remove untrusted local user accounts and applications on multi-user Windows systems to reduce local attack surface.

Patch Information

Google addressed CVE-2026-87554 in the Chrome Stable channel for Desktop at version 153.0.8010.36. Deployment details and release notes are documented in the Google Chrome Stable Update advisory. Tracking metadata for the underlying fix is available in the Chromium Issue Tracker entry.

Workarounds

Disable Chrome Remote Desktop and the Chromoting host service on systems where remote desktop functionality is not required until patching is complete.
Restrict local logon rights on Windows endpoints so only trusted administrative users can run local programs against Chromoting.
Apply application control policies (Windows Defender Application Control or AppLocker) to block execution of unapproved local binaries that could stage a race condition exploit.

bash

# Configuration example: verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Stop and disable Chrome Remote Desktop host service if not required
sc stop chromoting
sc config chromoting start= disabled