CVE-2026-95346: Google Chrome Chromoting UI Spoofing Flaw

CVE-2026-95346 Overview

CVE-2026-95346 is a user interface (UI) misrepresentation vulnerability in the Chromoting component of Google Chrome. Chromoting powers Chrome Remote Desktop functionality. Versions of Google Chrome prior to 154.0.8037.57 are affected. A remote attacker can spoof UI elements by sending crafted network traffic to a target session. Google's Chromium project classifies the underlying issue at Medium severity and maps it to CWE-451: User Interface Misrepresentation of Critical Information. Successful exploitation could mislead users into trusting attacker-controlled content presented within legitimate remote desktop UI surfaces.

Critical Impact
A remote attacker can spoof UI elements in Chrome Remote Desktop sessions, enabling social engineering attacks that trick users into acting on falsified interface content.

Affected Products

Google Chrome desktop versions prior to 154.0.8037.57
Chromoting (Chrome Remote Desktop) component
Chromium-based builds incorporating the vulnerable Chromoting code path

Discovery Timeline

2026-09-29 - CVE-2026-95346 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95346

Vulnerability Analysis

The flaw resides in Chromoting, the code base that implements Chrome Remote Desktop. Chromoting brokers input, display, and control messages between a host and a client over the network. The vulnerability allows a remote attacker to craft network traffic that causes Chrome to render UI elements in a misleading state. Because the spoofed content appears inside a trusted Chromoting surface, users lose the ability to distinguish genuine prompts from attacker-controlled ones. This category of weakness, [CWE-451], enables phishing, consent-dialog spoofing, and permission-prompt deception without executing code on the victim system.

Root Cause

The root cause is improper representation of security-relevant UI state when Chromoting processes untrusted network input. Rather than validating that rendered UI reflects the actual state of the connection or the origin of a message, the component displays attacker-influenced content in trusted areas of the interface. Google fixed the defect in Chrome 154.0.8037.57. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires a network path to a Chromoting session and the ability to deliver crafted traffic that the client will render. No authentication or user interaction is required to trigger the spoofing behavior, though the impact depends on a user acting on the falsified UI. The vulnerability does not grant code execution or direct data theft. Instead, it primes downstream social engineering, such as tricking a user into approving a session, clicking a fake control, or disclosing credentials into what appears to be legitimate Chrome Remote Desktop chrome.

Detection Methods for CVE-2026-95346

Indicators of Compromise

Chrome desktop clients reporting a version earlier than 154.0.8037.57 in fleet inventory
Unexpected inbound Chromoting or Chrome Remote Desktop signaling traffic to endpoints that do not use remote desktop
User reports of unusual prompts, permission dialogs, or session banners inside Chrome Remote Desktop

Detection Strategies

Inventory installed browser versions using endpoint telemetry and flag any Chrome build below 154.0.8037.57
Correlate Chromoting network activity with authorized remote-support workflows to surface anomalous sessions
Monitor for phishing follow-on activity, such as credential submission to non-corporate domains after Chrome Remote Desktop use

Monitoring Recommendations

Ingest browser version and update-status data into the security data lake to track patch coverage over time
Alert on Chrome processes older than the fixed version that establish outbound connections to Chromoting relay infrastructure
Review Chrome Remote Desktop host and client logs for unexpected session initiations from untrusted networks

How to Mitigate CVE-2026-95346

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all managed endpoints
Force a browser relaunch through enterprise policy to ensure the patched binary is loaded
Audit which users and endpoints have Chrome Remote Desktop enabled and disable it where not required

Patch Information

Google addressed CVE-2026-95346 in the stable channel release documented in the Chrome Release Blog Update. Administrators should deploy Chrome 154.0.8037.57 or newer through their existing browser management channel. Chromium downstream vendors should incorporate the corresponding upstream fix referenced in the Chromium Issue Tracker Entry.

Workarounds

Disable Chrome Remote Desktop via enterprise policy (RemoteAccessHostFirewallTraversal and related settings) on endpoints that do not require it
Restrict Chromoting network egress to known relay endpoints using firewall or secure web gateway rules
Train remote-support users to verify session initiators through an out-of-band channel before approving prompts

bash

# Configuration example: disable Chrome Remote Desktop host via Chrome enterprise policy (Linux)
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/disable_crd.json
{
  "RemoteAccessHostFirewallTraversal": false,
  "RemoteAccessHostAllowRemoteAccessConnections": false,
  "RemoteAccessHostAllowClientPairing": false
}
EOF

# Verify installed Chrome version meets the patched build
google-chrome --version   # must report 154.0.8037.57 or later