CVE-2026-84334: Incorrect authorization in Google Chrome

CVE-2026-84334 is an incorrect authorization vulnerability in the Chromoting feature of Google Chrome on Windows platforms before version 152.0.7977.75. This vulnerability enables a local attacker to bypass sandbox restrictions and execute arbitrary code outside the sandbox environment. The CVSS 3.1 base score is 8.1, indicating high severity, with attack vector local, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor advisory URL is provided but does not explicitly state the availability of a patch or remediation level.

Successful exploitation allows a local attacker to execute arbitrary code outside the sandbox, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This elevates the risk of unauthorized code execution and system control by an attacker with local access.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation of a fix, users should restrict local access to trusted users only and monitor for updates from Google.