CVE-2026-10887: Critical Chrome Chromoting Use-After-Free RCE on macOS

Technical summary

CVE-2026-10887 is a use-after-free vulnerability (CWE-416) in the Chromoting module of Google Chrome on macOS. Chromoting is Chrome's remote desktop protocol implementation. The flaw permits a remote unauthenticated attacker to cause a memory corruption condition by sending malicious network traffic, leading to arbitrary code execution in the context of the browser process. The vulnerability has a CVSS v3.1 score of 8.1 (HIGH severity) with a network-based attack vector, high complexity, no privileges required, and no user interaction needed. While Chromium has assigned it Critical severity internally, the CVSS rating reflects the high exploitability and impact potential.

Business impact

Successful exploitation enables full code execution within the Chrome browser process, potentially allowing attackers to steal sensitive data, install malware, access locally cached credentials, or pivot to adjacent systems. Given that Chromoting is commonly used for remote IT support and administrative access, compromise could extend beyond the immediate workstation to trusted systems. Organizations relying on Chrome for remote work or remote desktop access face elevated risk. The 'no user interaction' requirement means users cannot be socially engineered into clicking a link—passive network exposure is sufficient.

Affected systems

Google Chrome on Apple macOS versions prior to 149.0.7827.53 are affected. macOS itself is listed as an affected product, though the vulnerability is specific to Chrome running on macOS; macOS versions themselves do not require patching. Any organization or individual running Chrome on a Mac with a version number below 149.0.7827.53 should be considered at risk.

Exploitability

The vulnerability requires network access but no authentication or user interaction, making it readily exploitable by a remote attacker. However, the CVSS 'high complexity' rating suggests the attack is non-trivial—the attacker must craft specific malicious network traffic to trigger the use-after-free condition. The lack of public exploit code and the absence of KEV (Known Exploited Vulnerability) status as of the data snapshot indicate active in-the-wild exploitation has not yet been confirmed, but the attack surface is broad since any networked Mac running Chrome is potentially vulnerable during Chromoting sessions or related network activity.

Remediation

Update Google Chrome on macOS to version 149.0.7827.53 or later immediately. This is a priority patch addressing a critical remote code execution flaw. Users should enable automatic updates if not already active. Verify the installed version via Chrome menu > About Google Chrome, which will display the current version and trigger an update check if needed. No workarounds are available for this use-after-free bug; patching is the only mitigation.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later on all affected macOS systems. Google Chrome's auto-update mechanism will push this patch automatically to users, but organizations with managed Chrome deployments should verify rollout completion within 48–72 hours of availability. For macOS systems managed via MDM or custom configurations, confirm that update policies allow or enforce installation of this version. If Chrome instances are pinned to older versions for compatibility reasons, risk acceptance should be documented and escalated to leadership given the Critical severity rating.

Detection guidance

Monitor Chrome process version strings across your macOS fleet to identify systems still running versions below 149.0.7827.53. Endpoint detection and response (EDR) tools should be tuned to flag any unusual memory corruption crashes in Chrome or suspicious child process spawning from the browser. Network-based detection is limited since the malicious traffic would need deep packet inspection of Chromoting protocol streams; focus detection efforts on host-level signals such as unexpected code execution from chrome.exe or chrome helper processes. Log Chrome update events to verify timely patching compliance.

Why prioritize this

This vulnerability merits immediate patching priority due to its network-exploitable remote code execution capability, the 'no user interaction' requirement, high attack surface (any Mac running Chrome), and Chromium's Critical severity classification. Although not yet in the KEV catalog, the combination of high CVSS score and ease of triggering makes it a prime target for threat actors. Organizations should treat this as a zero-day equivalent and prioritize deployment within 24–48 hours.

Risk score, explained

The CVSS 8.1 (HIGH) score reflects a remote network attack requiring no privileges or user interaction, but with high attack complexity. The severity is constrained from CRITICAL to HIGH due to the complexity requirement—the attacker cannot trivially exploit this via a single malformed packet but must precisely craft network traffic to trigger the memory corruption. However, given Chromium's internal Critical rating and the broad attack surface, the practical risk is elevated; organizations should treat this as effectively critical and patch accordingly.

Frequently asked questions