Chrome · Chromoting › Remoting
CVE-2026-106316
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/continue_window_mac.mmremoting/host/disconnect_window_mac.mm
Patch
From c7a932d772cd4948f6199ee2b70c5e149ef4b357 Mon Sep 17 00:00:00 2001
From: Joe Downing <joedow@google.com>
Date: Tue, 01 Sep 2026 14:07:32 -0700
Subject: [PATCH] [remoting] Set NSWindow collectionBehavior on macOS host dialogs
In Chrome Remote Desktop on macOS, the disconnect banner ('Stop
Sharing') and continue alert windows lacked explicit
collectionBehavior flags, relying on default single-space assignment.
Injected remote input could switch Spaces or enter full-screen mode,
causing the active view to switch to a Space where the security indicators were not visible.
This change configures:
- NSWindowCollectionBehaviorCanJoinAllSpaces
- NSWindowCollectionBehaviorFullScreenAuxiliary
- NSWindowCollectionBehaviorStationary
on DisconnectWindow, ContinueWindow shade windows, and the continue
alert dialog window so they remain persistently visible across Spaces
and Fullscreen mode.
TAG=agy
CONV=72b32ff4-2fa0-4ff3-a7c4-c0f0705be513
Bug: 554556423
Change-Id: Ibc36548e72eff07c8e947ab5b18371ee1d603217
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8330389
Reviewed-by: Yuwei Huang <yuweih@chromium.org>
Commit-Queue: Joe Downing <joedow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1690116}
---
diff --git a/remoting/host/continue_window_mac.mm b/remoting/host/continue_window_mac.mm
index c825162..0dab368 100644
--- a/remoting/host/continue_window_mac.mm
+++ b/remoting/host/continue_window_mac.mm
@@ -114,6 +114,9 @@
// Leave the dock and menu bar exposed so the user has some basic level
// of control (like they can quit Chromium).
shade.level = NSModalPanelWindowLevel - 1;
+ shade.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+ NSWindowCollectionBehaviorFullScreenAuxiliary |
+ NSWindowCollectionBehaviorStationary;
[shade orderFront:nil];
[_shades addObject:shade];
}
@@ -142,6 +145,10 @@
NSWindow* continue_window = _continue_alert.window;
[continue_window center];
continue_window.level = NSModalPanelWindowLevel;
+ continue_window.collectionBehavior =
+ NSWindowCollectionBehaviorCanJoinAllSpaces |
+ NSWindowCollectionBehaviorFullScreenAuxiliary |
+ NSWindowCollectionBehaviorStationary;
[continue_window orderWindow:NSWindowAbove
relativeTo:_shades.lastObject.windowNumber];
[continue_window makeKeyWindow];
diff --git a/remoting/host/disconnect_window_mac.mm b/remoting/host/disconnect_window_mac.mm
index 1eea432..67c03d4 100644
--- a/remoting/host/disconnect_window_mac.mm
+++ b/remoting/host/disconnect_window_mac.mm
@@ -335,6 +335,12 @@
// Pull the window up to Status Level so that it always displays.
[self setLevel:NSStatusWindowLevel];
+
+ // Allow the window to join all spaces, appear with full-screen windows, and
+ // remain stationary during Mission Control / Exposé.
+ self.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+ NSWindowCollectionBehaviorFullScreenAuxiliary |
+ NSWindowCollectionBehaviorStationary;
}
return self;
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page