Chrome · Chromoting › Remoting
CVE-2026-106236
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/disconnect_window_win.cc
Patch
From 785e12f4a8030d38e0f6252f327e3f26ee41c90b Mon Sep 17 00:00:00 2001
From: Joe Downing <joedow@google.com>
Date: Tue, 08 Sep 2026 10:28:03 -0700
Subject: [PATCH] [remoting] Use ElideEmail in Windows host disconnect dialog
Applies remoting::ElideEmail in DisconnectWindowWin on Windows so that
client emails are bounded in length while preserving the username prefix
and authentic domain suffix.
Also removes post-format truncation at kMaxSharingWithTextLength and
sanitizes directional formatting after elision.
Bug: 556233068
Change-Id: I51216458ff99341d4101a26fa7a08517f28cae1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360396
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Commit-Queue: Jamie Walch <jamiewalch@chromium.org>
Auto-Submit: Joe Downing <joedow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1693890}
---
diff --git a/remoting/host/disconnect_window_win.cc b/remoting/host/disconnect_window_win.cc
index 808ba541..f7642ad1 100644
--- a/remoting/host/disconnect_window_win.cc
+++ b/remoting/host/disconnect_window_win.cc
@@ -15,6 +15,7 @@
#include "base/compiler_specific.h"
#include "base/functional/bind.h"
+#include "base/i18n/rtl.h"
#include "base/location.h"
#include "base/logging.h"
#include "base/memory/weak_ptr.h"
@@ -26,6 +27,7 @@
#include "base/win/scoped_gdi_object.h"
#include "base/win/scoped_hdc.h"
#include "base/win/scoped_select_object.h"
+#include "remoting/base/email_utils.h"
#include "remoting/host/client_session_control.h"
#include "remoting/host/host_window.h"
#include "remoting/host/input_monitor/local_input_monitor.h"
@@ -39,10 +41,6 @@
constexpr int DISCONNECT_HOTKEY_ID = 1000;
-// Maximum length of "Your desktop is shared with ..." message in UTF-16
-// characters.
-constexpr size_t kMaxSharingWithTextLength = 100;
-
constexpr wchar_t kShellTrayWindowName[] = L"Shell_TrayWnd";
constexpr int kWindowBorderRadius = 14;
@@ -144,8 +142,8 @@
// Used to watch for local input which will trigger the dialog to be reshown.
std::unique_ptr<LocalInputMonitor> local_input_monitor_;
- // Specifies the remote user name.
- std::string username_;
+ // Specifies the remote user's email address.
+ std::string email_;
bool was_auto_hidden_ = false;
base::OneShotTimer auto_hide_timer_;
@@ -212,7 +210,7 @@
client_session_control_ = client_session_control;
std::string client_jid = client_session_control_->client_jid();
- username_ = client_jid.substr(0, client_jid.find('/'));
+ email_ = client_jid.substr(0, client_jid.find('/'));
if (!BeginDialog()) {
EndDialog();
return;
@@ -605,12 +603,15 @@
return false;
}
- // Format and truncate "Your desktop is shared with ..." message.
+ // Format "Your desktop is shared with ..." message.
+ std::u16string email = base::UTF8ToUTF16(email_);
+ email = base::CollapseWhitespace(email,
+ /*trim_sequences_with_line_breaks=*/true);
+ email = ElideEmail(email);
+ base::i18n::SanitizeUserSuppliedString(&email);
+
message_text = base::AsWString(base::ReplaceStringPlaceholders(
- base::AsString16(message_text), base::UTF8ToUTF16(username_), nullptr));
- if (message_text.length() > kMaxSharingWithTextLength) {
- message_text.erase(kMaxSharingWithTextLength);
- }
+ base::AsString16(message_text), email, nullptr));
if (!SetWindowText(hwnd_message, message_text.c_str())) {
return false;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page