Chrome · Chromoting › Remoting
CVE-2026-106272
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/disconnect_window_win.ccremoting/host/win/core.rc.jinja2
Patch
From de8733b6cba641ad3c1072f13daed3a5a66e2068 Mon Sep 17 00:00:00 2001 From: Joe Downing <[email protected]> Date: Tue, 08 Sep 2026 13:42:28 -0700 Subject: [PATCH] [remoting] Document and assert disconnect window virtual desktop invariant Windows Desktop Window Manager (DWM) excludes unowned WS_EX_TOOLWINDOW windows (without WS_EX_APPWINDOW) from Shell Virtual Desktop management, ensuring the CRD disconnect indicator dialog is never cloaked (DWMWA_CLOAKED) across virtual desktop transitions (e.g., Win+Ctrl+D). This change adds architectural documentation to core.rc.jinja2 and disconnect_window_win.cc explaining this invariant, and adds DCHECKs in DisconnectWindowWin::BeginDialog() to guard against regressions. TAG=agy CONV=a52bf02c-a579-4a74-97f6-2174833e8215 Fixed: 556259957 Change-Id: I77bc409463548da3187166adecfb62401497ef14 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8371824 Commit-Queue: Joe Downing <[email protected]> Reviewed-by: Jamie Walch <[email protected]> Cr-Commit-Position: refs/heads/main@{#1694027} --- diff --git a/remoting/host/disconnect_window_win.cc b/remoting/host/disconnect_window_win.cc index 55e2d380..0b5d593 100644 --- a/remoting/host/disconnect_window_win.cc +++ b/remoting/host/disconnect_window_win.cc @@ -330,6 +330,14 @@ return false; } + // IDD_DISCONNECT must have WS_EX_TOOLWINDOW and must NOT have + // WS_EX_APPWINDOW. Unowned WS_EX_TOOLWINDOW popups are excluded from Windows + // Shell Virtual Desktop management, ensuring Desktop Window Manager (DWM) + // never cloaks the disconnect window when switching virtual desktops + // (Win+Ctrl+D). See crbug.com/556259957. + DCHECK(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_TOOLWINDOW); + DCHECK(!(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_APPWINDOW)); + // Set up handler for Ctrl-Alt-Esc shortcut. if (!has_hotkey_ && RegisterHotKey(hwnd_, DISCONNECT_HOTKEY_ID, MOD_ALT | MOD_CONTROL, VK_ESCAPE)) { diff --git a/remoting/host/win/core.rc.jinja2 b/remoting/host/win/core.rc.jinja2 index eed5835a..334f445 100644 --- a/remoting/host/win/core.rc.jinja2 +++ b/remoting/host/win/core.rc.jinja2 @@ -53,6 +53,15 @@ #endif // (REMOTING_HOST_BINARY == BINARY_CORE) +// Note on dialog extended styles: +// WS_EX_TOOLWINDOW is required so that Desktop Window Manager (DWM) treats +// this unowned dialog as a tool window and excludes it from Windows Shell +// Virtual Desktop management. This ensures the indicator dialog is never +// cloaked (DWMWA_CLOAKED) and remains visible and interactive across all +// virtual desktops (e.g. when Win+Ctrl+D is pressed). +// WS_EX_APPWINDOW must NOT be added here, as it would force the window into +// virtual desktop tracking and cause it to be cloaked when switching desktops. +// See crbug.com/556259957. IDD_DISCONNECT DIALOGEX 0, 0, 145, 24 STYLE DS_SETFONT | WS_POPUP EXSTYLE WS_EX_TOPMOST | WS_EX_TOOLWINDOW {% if IsRtlLanguage(lang) %} | WS_EX_LAYOUTRTL | WS_EX_RTLREADING {% endif %}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page