Low chrome Spoofing 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUI misrepresentation in Chromoting
DescriptionUI misrepresentation in Chromoting
ComponentChromoting
Sub-componentRemoting
Bug ClassSpoofing
Tracker554556423
Fix commitc7a932d772cd (chromium/src) +13/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • remoting/host/continue_window_mac.mm
  • remoting/host/disconnect_window_mac.mm
From c7a932d772cd4948f6199ee2b70c5e149ef4b357 Mon Sep 17 00:00:00 2001
From: Joe Downing <[email protected]>
Date: Tue, 01 Sep 2026 14:07:32 -0700
Subject: [PATCH] [remoting] Set NSWindow collectionBehavior on macOS host dialogs

In Chrome Remote Desktop on macOS, the disconnect banner ('Stop
Sharing') and continue alert windows lacked explicit
collectionBehavior flags, relying on default single-space assignment.

Injected remote input could switch Spaces or enter full-screen mode,
causing the active view to switch to a Space where the security indicators were not visible.

This change configures:
- NSWindowCollectionBehaviorCanJoinAllSpaces
- NSWindowCollectionBehaviorFullScreenAuxiliary
- NSWindowCollectionBehaviorStationary

on DisconnectWindow, ContinueWindow shade windows, and the continue
alert dialog window so they remain persistently visible across Spaces
and Fullscreen mode.

TAG=agy
CONV=72b32ff4-2fa0-4ff3-a7c4-c0f0705be513

Bug: 554556423
Change-Id: Ibc36548e72eff07c8e947ab5b18371ee1d603217
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8330389
Reviewed-by: Yuwei Huang <[email protected]>
Commit-Queue: Joe Downing <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1690116}
---
diff --git a/remoting/host/continue_window_mac.mm b/remoting/host/continue_window_mac.mm
index c825162..0dab368 100644
--- a/remoting/host/continue_window_mac.mm
+++ b/remoting/host/continue_window_mac.mm
@@ -114,6 +114,9 @@
     // Leave the dock and menu bar exposed so the user has some basic level
     // of control (like they can quit Chromium).
     shade.level = NSModalPanelWindowLevel - 1;
+    shade.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+                               NSWindowCollectionBehaviorFullScreenAuxiliary |
+                               NSWindowCollectionBehaviorStationary;
     [shade orderFront:nil];
     [_shades addObject:shade];
   }
@@ -142,6 +145,10 @@
   NSWindow* continue_window = _continue_alert.window;
   [continue_window center];
   continue_window.level = NSModalPanelWindowLevel;
+  continue_window.collectionBehavior =
+      NSWindowCollectionBehaviorCanJoinAllSpaces |
+      NSWindowCollectionBehaviorFullScreenAuxiliary |
+      NSWindowCollectionBehaviorStationary;
   [continue_window orderWindow:NSWindowAbove
                     relativeTo:_shades.lastObject.windowNumber];
   [continue_window makeKeyWindow];
diff --git a/remoting/host/disconnect_window_mac.mm b/remoting/host/disconnect_window_mac.mm
index 1eea432..67c03d4 100644
--- a/remoting/host/disconnect_window_mac.mm
+++ b/remoting/host/disconnect_window_mac.mm
@@ -335,6 +335,12 @@
 
     // Pull the window up to Status Level so that it always displays.
     [self setLevel:NSStatusWindowLevel];
+
+    // Allow the window to join all spaces, appear with full-screen windows, and
+    // remain stationary during Mission Control / Exposé.
+    self.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+                              NSWindowCollectionBehaviorFullScreenAuxiliary |
+                              NSWindowCollectionBehaviorStationary;
   }
   return self;
 }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.