CVE-2026-14060: Chrome Chromoting Privilege Escalation on Windows

Technical summary

CVE-2026-14060 is an input validation vulnerability (CWE-20) in Chromoting, Chrome's remote access feature, running on Windows systems. The flaw allows privilege escalation when a local attacker can introduce a malicious file that bypasses input validation controls. The attack requires local access, no special privileges at the outset, and user interaction to trigger. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the local attack vector, low attack complexity, no prior privilege requirement, and high impact across confidentiality, integrity, and availability. While Chromium has assigned this a Low security severity internally, the CVSS score of 7.8 (HIGH) reflects the full impact of a successful privilege escalation on an affected system.

Business impact

Successful exploitation enables a local attacker to run code with elevated privileges on affected Windows machines. This can lead to unauthorized access to sensitive data, system compromise, installation of malware, and lateral movement within a network. Organizations relying on shared or multi-user Windows systems face elevated risk, as does any environment where users may be socially engineered to open files from untrusted sources. The requirement for user interaction somewhat limits blast radius, but privilege escalation is a critical stepping stone for further attacks.

Affected systems

Google Chrome prior to version 150.0.7871.47 running on Microsoft Windows is affected. The vulnerability is specific to the Chromoting component and does not affect Chrome on macOS, Linux, or other operating systems. Organizations using Chrome for remote access or general browsing on Windows, particularly in shared computing environments, should assess their exposure.

Exploitability

Exploitation requires a local attacker with the ability to place or deliver a malicious file to the target machine and convince a user to open it. The low attack complexity and absence of privilege requirements at initiation make this feasible in realistic scenarios—for example, via email attachment, USB drive, or network share. However, the user interaction requirement provides a window for training and vigilance to reduce risk. The vulnerability is not known to be exploited in the wild at this time, as it has not been added to the CISA KEV catalog.

Remediation

Organizations should update Google Chrome to version 150.0.7871.47 or later on all Windows systems. This patch resolves the input validation flaw in Chromoting. In parallel, reinforce user security awareness regarding opening files from untrusted sources, and consider restricting Chromoting access through group policy or network controls if it is not essential for your operations.

Patch guidance

Verify that Chrome auto-update is enabled on all Windows endpoints, as Chrome typically updates automatically. Users can manually check for updates via Chrome menu > Settings > About Google Chrome, which triggers an immediate check and restart if updates are pending. For organizations managing Chrome through Active Directory or mobile device management, deploy the update through your standard patch management process. Prioritize systems with users who frequently receive external files or use shared workstations.

Detection guidance

Monitor for failed and successful privilege escalation attempts on Windows systems running Chrome, particularly anomalous process creation with elevated privileges spawned from chrome.exe or its child processes. Log and alert on file access patterns involving Chrome's Chromoting executable and any associated temp or cache directories. Review user activity logs for suspicious file opens prior to privilege escalation events. Endpoint detection and response (EDR) tools should be tuned to flag unexpected elevation of privilege from browser-related processes.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. While the CVSS score is HIGH and privilege escalation is a serious threat, the requirement for local access and user interaction to open a malicious file limits the attack surface compared to remote code execution flaws. Prioritize systems with high-value users, shared workstations, and environments where external file ingestion is common. The absence from the KEV catalog indicates no evidence of active exploitation.

Risk score, explained

The CVSS 7.8 (HIGH) score reflects the severe impact of privilege escalation—confidentiality, integrity, and availability are all fully compromised once the attacker gains elevated rights. The local attack vector and low attack complexity mean any user on a system can potentially be the entry point. However, the user interaction requirement prevents this from being Critical. Organizations should treat this as a material risk that requires timely remediation but can be managed through standard patching cycles and user awareness.

Frequently asked questions