diff --git a/remoting/host/chromoting_host_services_client.cc b/remoting/host/chromoting_host_services_client.cc
index 8c9354375aafe..064974705714f 100644
--- a/remoting/host/chromoting_host_services_client.cc
+++ b/remoting/host/chromoting_host_services_client.cc
@@ -36,7 +36,17 @@ bool g_initialized = false;
 mojo::PendingRemote<mojom::ChromotingHostServices> ConnectToServer(
     const std::vector<mojo::NamedPlatformChannel::ServerName>& server_names) {
   for (const auto& server_name : server_names) {
-    auto endpoint = named_mojo_ipc_server::ConnectToServer(server_name);
+    mojo::NamedPlatformChannel::Options options;
+    options.server_name = server_name;
+#if BUILDFLAG(IS_WIN)
+    // Reject named-pipe squatters running at a lower integrity level than this
+    // process. The legitimate ChromotingHostServices server runs as SYSTEM in
+    // session 0; without this check any session-0 process passes the
+    // GetNamedPipeServerSessionId gate below and is then treated as a
+    // fully-trusted ipcz broker by IncomingInvitation::Accept().
+    options.verify_server_privilege = true;
+#endif
+    auto endpoint = named_mojo_ipc_server::ConnectToServer(options);
     if (!endpoint.is_valid()) {
       VLOG(1) << "Cannot connect to IPC through server name " << server_name
               << ". Endpoint is invalid.";