This vulnerability (CVE-2026-7994) affects the Chromoting feature in Google Chrome on Windows versions before 148.0.7778.96. It is caused by an inappropriate implementation that enables a local attacker to escalate privileges to the OS level via a crafted malicious file. The CVSS vector indicates the attack requires local access with low complexity and user interaction, but no privileges initially. The impact includes high confidentiality, integrity, and availability consequences. The vulnerability is categorized under CWE-269 (Improper Privilege Management). The vendor advisory is available but does not explicitly state patch or remediation status.

Successful exploitation allows a local attacker to escalate privileges on the Windows OS, potentially gaining full control over the affected system. This can lead to unauthorized access, modification, or disruption of system resources. The CVSS score of 7.8 reflects a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should avoid executing untrusted files locally and restrict local access to trusted users only. Monitor for updates from Google Chrome and apply updates promptly once available.