CVE-2026-106183

Analyzed Analyzed - Analysis Complete

Missing Authorization in Chromoting in Google Chrome

Publication date: 2026-10-06

Last updated on: 2026-10-08

Assigner: Chrome

Description

Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106183

EUVD

EUVD-2026-93577

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authorization in Chromoting for Google Chrome on Windows. It allows a remote attacker to access sensitive information by sending specially crafted network traffic. The issue was rated as Medium severity by Chromium.

Detection Guidance

This vulnerability involves missing authorization in Chromoting in Google Chrome on Windows. Detection primarily requires verifying Chrome version and monitoring network traffic for unauthorized access attempts. Check Chrome version via command line: chrome.exe --version. If version is below 155.0.8059.39, the system is vulnerable. Network monitoring tools like Wireshark can inspect traffic for suspicious Chromoting protocol interactions.

Impact Analysis

An attacker could exploit this to steal sensitive data from your system if you are using an affected version of Google Chrome on Windows. This might include personal information or other confidential details transmitted over the network.

Compliance Impact

This vulnerability allows a remote attacker to obtain sensitive information via crafted network traffic due to missing authorization in Chromoting. This could potentially lead to unauthorized access to personal or sensitive data, which may violate compliance requirements under GDPR (for personal data protection) and HIPAA (for protected health information).

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the missing authorization vulnerability in Chromoting.

Hi! I’m here to help you understand CVE-2026-106183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70