Chrome · Chromoting › Remoting
CVE-2026-106272
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/disconnect_window_win.ccremoting/host/win/core.rc.jinja2
Patch
From de8733b6cba641ad3c1072f13daed3a5a66e2068 Mon Sep 17 00:00:00 2001
From: Joe Downing <joedow@google.com>
Date: Tue, 08 Sep 2026 13:42:28 -0700
Subject: [PATCH] [remoting] Document and assert disconnect window virtual desktop invariant
Windows Desktop Window Manager (DWM) excludes unowned WS_EX_TOOLWINDOW
windows (without WS_EX_APPWINDOW) from Shell Virtual Desktop management,
ensuring the CRD disconnect indicator dialog is never cloaked
(DWMWA_CLOAKED) across virtual desktop transitions (e.g., Win+Ctrl+D).
This change adds architectural documentation to core.rc.jinja2 and
disconnect_window_win.cc explaining this invariant, and adds DCHECKs in
DisconnectWindowWin::BeginDialog() to guard against regressions.
TAG=agy
CONV=a52bf02c-a579-4a74-97f6-2174833e8215
Fixed: 556259957
Change-Id: I77bc409463548da3187166adecfb62401497ef14
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8371824
Commit-Queue: Joe Downing <joedow@chromium.org>
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1694027}
---
diff --git a/remoting/host/disconnect_window_win.cc b/remoting/host/disconnect_window_win.cc
index 55e2d380..0b5d593 100644
--- a/remoting/host/disconnect_window_win.cc
+++ b/remoting/host/disconnect_window_win.cc
@@ -330,6 +330,14 @@
return false;
}
+ // IDD_DISCONNECT must have WS_EX_TOOLWINDOW and must NOT have
+ // WS_EX_APPWINDOW. Unowned WS_EX_TOOLWINDOW popups are excluded from Windows
+ // Shell Virtual Desktop management, ensuring Desktop Window Manager (DWM)
+ // never cloaks the disconnect window when switching virtual desktops
+ // (Win+Ctrl+D). See crbug.com/556259957.
+ DCHECK(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_TOOLWINDOW);
+ DCHECK(!(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_APPWINDOW));
+
// Set up handler for Ctrl-Alt-Esc shortcut.
if (!has_hotkey_ && RegisterHotKey(hwnd_, DISCONNECT_HOTKEY_ID,
MOD_ALT | MOD_CONTROL, VK_ESCAPE)) {
diff --git a/remoting/host/win/core.rc.jinja2 b/remoting/host/win/core.rc.jinja2
index eed5835a..334f445 100644
--- a/remoting/host/win/core.rc.jinja2
+++ b/remoting/host/win/core.rc.jinja2
@@ -53,6 +53,15 @@
#endif // (REMOTING_HOST_BINARY == BINARY_CORE)
+// Note on dialog extended styles:
+// WS_EX_TOOLWINDOW is required so that Desktop Window Manager (DWM) treats
+// this unowned dialog as a tool window and excludes it from Windows Shell
+// Virtual Desktop management. This ensures the indicator dialog is never
+// cloaked (DWMWA_CLOAKED) and remains visible and interactive across all
+// virtual desktops (e.g. when Win+Ctrl+D is pressed).
+// WS_EX_APPWINDOW must NOT be added here, as it would force the window into
+// virtual desktop tracking and cause it to be cloaked when switching desktops.
+// See crbug.com/556259957.
IDD_DISCONNECT DIALOGEX 0, 0, 145, 24
STYLE DS_SETFONT | WS_POPUP
EXSTYLE WS_EX_TOPMOST | WS_EX_TOOLWINDOW {% if IsRtlLanguage(lang) %} | WS_EX_LAYOUTRTL | WS_EX_RTLREADING {% endif %}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page