Google Chrome: Security bypass in Chromoting on macOS
Summary
Google Chrome on macOS contains an incomplete cleanup flaw in Chromoting, the component behind Chrome Remote Desktop features. A remote attacker can bypass system access restrictions by sending crafted network traffic. Google rates the issue Low, while the NVD CVSS score is 9.1; this conflict should be verified before prioritising. No exploitation has been reported.
Affected
- Google Chrome on macOS prior to 155.0.8059.39
- Linux and Windows are not listed in the CVE record
Fixed in
- Google Chrome 155.0.8059.39 or later (Mac build listed as 155.0.8059.40 by a secondary source; the Google Chrome Releases post lists 155.0.8059.39/.40 for Windows and Mac)
Workaround
- Unknown. No vendor workaround found.
- Chrome updates on Mac roll out gradually; administrators can enforce a version via Chrome Enterprise policy.
- If the Chrome Remote Desktop host function is not required on Macs, disable or remove it until the update is applied.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Not listed in the CISA KEV catalogue according to a third-party aggregator; verify directly at CISA.
Our recommendation
- Update Google Chrome on all Macs to 155.0.8059.39 or later, or 155.0.8059.40 for the Mac build.
- Check whether Chrome Remote Desktop hosts are enabled on Macs and reachable from the network, and disable them if not needed.
- Verify the CVSS score on NVD before using it for prioritisation.
- Monitor the vendor release notes for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry (not retrieved) issues.chromium.org
- OSV: DEBIAN-CVE-2026-106294 osv.dev
- VulDB: CVE-2026-106294 vuldb.com
- Ubuntu security tracker: CVE-2026-106294 ubuntu.com
- Strix: CVE-2026-106294 www.strix.ai
- Browserhow: Chrome 155 stable update browserhow.com
- Google Chrome Enterprise: Mac version pinning support.google.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:24.
Original description (NVD)
Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.