CVE-2026-11170: Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149

Synopsis

An inappropriate implementation flaw in the Chromoting component (Google's remote desktop feature) of Google Chrome on Linux allows a remote attacker to escalate privileges to the OS level. The vulnerability is reachable over the network with no authentication required, though exploitation involves elevated complexity due to environmental or timing conditions the attacker must satisfy. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the affected host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Chromoting service over the network; no local access or physical presence is needed.

• AuthenticationNot required

  No credentials or prior account access are needed to initiate the attack.

• Victim interactionNot required

  The exploit is delivered entirely via malicious network traffic and requires no action from a user on the target system.

• Attack complexityDetail

  Exploitation is non-trivial and depends on environmental factors such as race conditions, specific memory layout, or precise network timing that the attacker must engineer.

Blast Radius

• A successful attacker reads any file or process memory accessible on the host, including credentials, session tokens, and private keys.
• The attacker writes to or modifies files and system state at the OS level, enabling persistence mechanisms or tampering with application data.
• The attacker can terminate processes or exhaust resources, crashing the Chrome remote desktop session or other services on the host.
• OS-level privilege escalation means the attacker is not confined to the browser sandbox and can affect the entire Linux host, not just the Chrome process.