CVE-2026-87554

CVE-2026-87554 is a time-of-check/time-of-use (TOCTOU) race condition (CWE-367) in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows. It is triggered by a local program that wins a race against Chromoting's checks during the attack window, which the Chromium project rates High severity. A successful exploit lets the local attacker execute arbitrary code outside the Chrome sandbox on the Windows host, but it requires the attacker to already be able to run a program locally; no remote or web-browsing trigger is indicated. Only Google Chrome on Windows prior to 153.0.8010.36 is affected. There is no known in-the-wild exploitation, no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only about a 0.1% chance of exploitation in the next 30 days.

What to do: Update Google Chrome on Windows to 153.0.8010.36 or later and verify endpoints are current via chrome://settings/help or endpoint management tooling. Because exploitation requires an attacker who can already run a local program, this can follow a normal patch cadence, but prioritize shared, multi-user, or VDI/remote-desktop Windows hosts where local code execution by untrusted users is more likely. Non-Windows Chrome builds are not implicated by this advisory.