CVE-2026-10978: Chrome Chromoting Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-10978 is a use-after-free memory vulnerability (CWE-416) in the Chromoting subsystem of Google Chrome prior to version 149.0.7827.53. Chromoting is Chrome's remote desktop and remote assistance component. The flaw stems from improper memory management, where freed memory is accessed after deallocation, leading to potential code execution. The CVSS 3.1 score of 8.8 (HIGH) reflects the network vector, low attack complexity, and severe impact on confidentiality, integrity, and availability. The vulnerability requires user interaction, preventing fully remote unauthenticated exploitation but remaining highly dangerous in realistic attack scenarios involving social engineering or cross-site request forgery.

Business impact

Organizations relying on Chrome Chromoting for remote support, employee remote assistance, or cross-platform remote access face immediate risk. A compromised Chrome process can lead to unauthorized access to sensitive data, lateral movement within corporate networks, deployment of malware, or business disruption. The requirement for user interaction means targeted phishing campaigns or deceptive social engineering can weaponize this vulnerability at scale. Remote work environments and support teams are particularly exposed. The vulnerability also affects the confidentiality and integrity of communications normally assumed secure under remote assistance scenarios.

Affected systems

Google Chrome on Windows systems running versions prior to 149.0.7827.53 are affected. The vulnerability is specific to Windows and manifests through the Chromoting remote desktop component. Other Chromium-based browsers and Chrome on other operating systems may require separate assessment. Microsoft Windows is listed as an affected product; however, Windows itself is not the source of the vulnerability—Chrome on Windows is the actual vulnerable software. Users and organizations should verify their Chrome version and apply the patch immediately.

Exploitability

Exploitability is high in practical terms despite the requirement for user interaction. An attacker can craft malicious network traffic and socially engineer a user into accepting a remote connection, visiting a compromised website that triggers Chromoting, or opening a malicious email attachment that initiates the vulnerability. The attack surface is broad because Chromoting is built into Chrome and accessible to any remote attacker who can send network packets to an affected browser. The low attack complexity and lack of privilege requirements mean that once user interaction occurs, exploitation is straightforward. While the vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities (KEV) catalog, this does not preclude active exploitation in the wild.

Remediation

Immediate action is required: update Google Chrome to version 149.0.7827.53 or later. Chrome includes automatic update functionality; verify that automatic updates are enabled in your environment. For enterprise deployments, use Chrome's group policy or configuration management tools to enforce the patch across all Windows systems. Users should manually check Settings > About Google Chrome to trigger an immediate update if automatic background updates are delayed. Once patched, the vulnerability is closed. No workarounds are available; patching is the only remediation.

Patch guidance

Verify your current Chrome version by navigating to chrome://version/ in the address bar. If the version is 149.0.7827.53 or later, you are patched. For automatic updates, allow Chrome to restart and apply patches; check Settings > About Google Chrome, which will automatically check for and apply updates. In enterprise environments, use Chrome's MSI installer with automatic update policies, or leverage third-party mobile device management (MDM) solutions to enforce version compliance. Schedule patch deployment during regular maintenance windows and confirm successful deployment across all endpoints. Test Chromoting functionality after patching to ensure remote access features remain operational.

Detection guidance

Monitor Chrome process memory access patterns and abnormal terminations or crashes in Chromoting sessions, which may indicate exploitation attempts. Implement endpoint detection and response (EDR) tools to flag suspicious activity within Chrome processes, including unexpected child process creation, registry modifications, or network connections outside normal remote desktop usage. Monitor for failed or anomalous Chromoting connection attempts, especially from unexpected sources. Log and alert on browser crashes or memory protection violations. Network-level detection is limited, but unusual spikes in remote desktop traffic or attempts to initiate Chromoting from suspicious IP addresses warrant investigation. Organizations should also monitor for post-exploitation indicators such as lateral movement or credential theft following confirmed Chromoting usage.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), direct path to arbitrary code execution, and applicability to widely deployed software (Chrome on Windows). While user interaction is required, realistic attack scenarios make this achievable through social engineering. The absence from the KEV catalog does not reduce urgency; threat actors actively hunt for recent Chrome vulnerabilities. Remote work environments and support organizations are high-value targets. Delaying patching exposes systems to compromise and creates risk for lateral movement, data exfiltration, and supply chain attacks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network attack vector—remote exploitation is possible; (2) low attack complexity—no special conditions beyond user interaction are required; (3) no privilege escalation required—the attacker inherits Chrome process privileges; (4) user interaction required—moderate risk reduction, but achievable via phishing; (5) high confidentiality, integrity, and availability impact—arbitrary code execution enables complete compromise. The absence of scope change (local impact only) prevents a critical rating, but the score remains in the high-risk band and warrants immediate action.

Frequently asked questions