Chrome · Chromoting › Remoting
CVE-2026-106316
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/continue_window_mac.mmremoting/host/disconnect_window_mac.mm
Patch
From c7a932d772cd4948f6199ee2b70c5e149ef4b357 Mon Sep 17 00:00:00 2001 From: Joe Downing <[email protected]> Date: Tue, 01 Sep 2026 14:07:32 -0700 Subject: [PATCH] [remoting] Set NSWindow collectionBehavior on macOS host dialogs In Chrome Remote Desktop on macOS, the disconnect banner ('Stop Sharing') and continue alert windows lacked explicit collectionBehavior flags, relying on default single-space assignment. Injected remote input could switch Spaces or enter full-screen mode, causing the active view to switch to a Space where the security indicators were not visible. This change configures: - NSWindowCollectionBehaviorCanJoinAllSpaces - NSWindowCollectionBehaviorFullScreenAuxiliary - NSWindowCollectionBehaviorStationary on DisconnectWindow, ContinueWindow shade windows, and the continue alert dialog window so they remain persistently visible across Spaces and Fullscreen mode. TAG=agy CONV=72b32ff4-2fa0-4ff3-a7c4-c0f0705be513 Bug: 554556423 Change-Id: Ibc36548e72eff07c8e947ab5b18371ee1d603217 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8330389 Reviewed-by: Yuwei Huang <[email protected]> Commit-Queue: Joe Downing <[email protected]> Cr-Commit-Position: refs/heads/main@{#1690116} --- diff --git a/remoting/host/continue_window_mac.mm b/remoting/host/continue_window_mac.mm index c825162..0dab368 100644 --- a/remoting/host/continue_window_mac.mm +++ b/remoting/host/continue_window_mac.mm @@ -114,6 +114,9 @@ // Leave the dock and menu bar exposed so the user has some basic level // of control (like they can quit Chromium). shade.level = NSModalPanelWindowLevel - 1; + shade.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces | + NSWindowCollectionBehaviorFullScreenAuxiliary | + NSWindowCollectionBehaviorStationary; [shade orderFront:nil]; [_shades addObject:shade]; } @@ -142,6 +145,10 @@ NSWindow* continue_window = _continue_alert.window; [continue_window center]; continue_window.level = NSModalPanelWindowLevel; + continue_window.collectionBehavior = + NSWindowCollectionBehaviorCanJoinAllSpaces | + NSWindowCollectionBehaviorFullScreenAuxiliary | + NSWindowCollectionBehaviorStationary; [continue_window orderWindow:NSWindowAbove relativeTo:_shades.lastObject.windowNumber]; [continue_window makeKeyWindow]; diff --git a/remoting/host/disconnect_window_mac.mm b/remoting/host/disconnect_window_mac.mm index 1eea432..67c03d4 100644 --- a/remoting/host/disconnect_window_mac.mm +++ b/remoting/host/disconnect_window_mac.mm @@ -335,6 +335,12 @@ // Pull the window up to Status Level so that it always displays. [self setLevel:NSStatusWindowLevel]; + + // Allow the window to join all spaces, appear with full-screen windows, and + // remain stationary during Mission Control / Exposé. + self.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces | + NSWindowCollectionBehaviorFullScreenAuxiliary | + NSWindowCollectionBehaviorStationary; } return self; }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page