An incorrect authorization check in the Chromoting component of Google Chrome on macOS allows a remote attacker to craft network traffic and bypass system access restrictions. The flaw is identified as CWE-863, meaning that an attacker can gain unauthorized access to a remote desktop session that could otherwise be protected by local system controls. This could enable the attacker to view or manipulate the user’s desktop environment, potentially exposing sensitive data or executing further actions on the host. The vulnerability is rated as critical with a CVSS score of 9.1, indicating a high overall risk to the system.

Google Chrome on macOS versions prior to 155.0.8059.39 are affected. The vulnerability applies to any installation of Chrome where Chromoting is enabled and listening for incoming remote desktop connections.

Because the flaw is triggered by crafted traffic sent over the network, a threat actor must reach the target device and target the Chromoting service. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. Nevertheless, the attacker can gain serious risk due to the high CVSS score of 9.1, which marks the vulnerability as critical. Updating to Chrome 155.0.8059.39 or later eliminates the flaw, while failure to patch leaves the system susceptible to unauthorized remote access via Chromoting.