CVE-2026-95305: Google Chrome Chromoting UI Spoofing Flaw

CVE-2026-95305 Overview

CVE-2026-95305 is a user interface (UI) misrepresentation vulnerability in the Chromoting component of Google Chrome. Chromoting is the technology behind Chrome Remote Desktop, which enables remote access sessions between browsers and hosts. A remote attacker can send crafted network traffic to spoof UI elements presented to the victim. Successful exploitation requires social engineering to persuade the user to act on the falsified interface. Google Chrome versions prior to 154.0.8037.57 are affected, and the Chromium project rates the security severity as Low. The weakness is categorized under [CWE-451: User Interface (UI) Misrepresentation of Critical Information].

Critical Impact
An attacker can manipulate Chromoting UI elements over the network to deceive users into approving or trusting attacker-controlled remote sessions.

Affected Products

Google Chrome desktop versions prior to 154.0.8037.57
Chromoting component (Chrome Remote Desktop functionality)
Chromium-based builds incorporating the vulnerable Chromoting code

Discovery Timeline

2026-09-29 - CVE-2026-95305 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database
2026-09 - Google Chrome Stable Channel update released addressing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-95305

Vulnerability Analysis

The vulnerability resides in Chromoting, the subsystem that implements Chrome Remote Desktop session negotiation, signaling, and UI presentation. A remote attacker who can influence network traffic reaching the Chromoting client can craft messages that cause the browser to render misleading UI elements. Because the deception occurs in trusted browser chrome, users lack visual cues to distinguish genuine prompts from attacker-controlled content. The flaw does not permit direct code execution or data disclosure without user interaction, but it enables convincing social engineering against Chromoting users. Successful attacks depend on high attack complexity, and the impact is limited to confidentiality of user actions and minor availability disruption of the Chromoting session.

Root Cause

The root cause is improper handling and presentation of network-supplied data in Chromoting UI rendering paths, matching [CWE-451]. Attacker-influenced fields flow into UI elements without sufficient validation or origin indication. This allows the interface to display information that misrepresents the source or intent of a remote session request.

Attack Vector

Exploitation is network-based and requires no privileges on the target system. The attacker sends crafted Chromoting traffic to a user running a vulnerable Chrome build. The victim must then interact with the spoofed UI, such as accepting a session prompt or trusting a falsified connection indicator. Technical specifics remain restricted; see Chromium Issue Tracker #553921181 for the tracked bug entry.

Detection Methods for CVE-2026-95305

Indicators of Compromise

Unexpected Chrome Remote Desktop session prompts appearing outside of user-initiated remote access workflows.
Chromoting signaling traffic to or from endpoints that have no legitimate business use of Chrome Remote Desktop.
Chrome browser processes with active Chromoting connections while the user reports UI anomalies.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 154.0.8037.57.
Correlate browser telemetry with network traffic to identify Chromoting sessions initiated without a corresponding user launch event.
Review user reports of unexpected remote desktop dialogs and preserve browser logs for forensic review.

Monitoring Recommendations

Enable enterprise Chrome telemetry through Chrome Browser Cloud Management to track version compliance.
Monitor DNS and TLS Server Name Indication (SNI) traffic for Chrome Remote Desktop endpoints from hosts that should not use the service.
Alert on new Chromoting host registrations tied to user accounts that have not previously enabled remote access.

How to Mitigate CVE-2026-95305

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched Chromoting component is loaded.
Disable Chrome Remote Desktop for user populations that do not require the feature.

Patch Information

Google released the fix in the Chrome Stable Channel update that shipped Chrome 154.0.8037.57. Enterprise administrators should deploy the update through Chrome Browser Cloud Management, Group Policy, or their existing software distribution tooling. Refer to the Google Chrome Stable Update advisory for full release details and the Chromium Issue Tracker #553921181 entry for tracking.

Workarounds

Set the RemoteAccessHostFirewallTraversal and related Chrome Enterprise policies to restrict or disable Chrome Remote Desktop until patching completes.
Block outbound access to Chrome Remote Desktop relay endpoints at the network perimeter for user groups that do not require remote desktop functionality.
Provide user awareness guidance that any unsolicited Chrome Remote Desktop prompt should be declined and reported to the security team.

bash

# Configuration example: Disable Chrome Remote Desktop via enterprise policy (Linux/macOS JSON policy)
cat >/etc/opt/chrome/policies/managed/disable_chromoting.json <<'EOF'
{
  "RemoteAccessHostFirewallTraversal": false,
  "RemoteAccessHostAllowRemoteAccessConnections": false,
  "RemoteAccessHostAllowClientPairing": false
}
EOF