Google Chrome CVE-2026-11276

The Cast feature must be active in Google Chrome (enabled by default in standard Chrome installations). The attacker must be positioned on the same local network segment as the targeted Chrome instance - physical or logical adjacency to the victim's Layer 2 broadcast domain is required. The exploit is delivered via malicious network traffic, requiring no authentication (PR:N) and no user interaction (UI:N). IMPORTANT DISCREPANCY: The CVSS vector assigns AV:L (Local access), which would require the attacker to have local system-level access, but the description specifies a local network segment attacker using network traffic - a mismatch. Exploitation conditions should be validated against the vendor advisory before assessing true scope. Environments where Chrome is used on isolated or enterprise-managed networks with no untrusted LAN participants face substantially reduced risk.

Real-world risk here is moderate-to-low despite a few complicating signals. The CVSS score of 5.1 (Medium) reflects limited confidentiality and integrity impact with no availability impact. EPSS data is not provided, and no KEV listing exists, meaning no confirmed active exploitation. There is a notable discrepancy in the CVSS vector: AV:L (Local) is assigned, yet the CVE description explicitly states 'attacker on the local network segment' exploiting 'malicious network traffic' - a scenario that would conventionally map to AV:A (Adjacent Network), not AV:L. This inconsistency should be verified against the Chromium issue tracker (issues.chromium.org/issues/501780338) and the vendor advisory before drawing firm conclusions about actual attack surface. If the true attack vector is adjacent-network, the realistic exposure is broader than AV:L implies. The no-privileges-required (PR:N) and no-user-interaction (UI:N) conditions increase concern if the vector is confirmed as network-adjacent. Chromium's own Low severity rating and the constrained impact (C:L/I:L) suggest this is not a critical priority but warrants patching in environments using Cast on shared networks.

An attacker connected to the same local network segment as a Chrome user (e.g., a shared office Wi-Fi or guest network) sends crafted Cast protocol packets or mDNS responses targeting Chrome's Cast implementation. By abusing the improper access control in the Cast subsystem, the attacker bypasses discretionary access controls, potentially reading limited Cast session metadata or injecting unauthorized Cast commands. No public exploit code has been identified at time of analysis, and the Chromium issue tracker entry (issues.chromium.org/issues/501780338) is the primary technical reference.