EUVD-2026-40583
GHSA-r2vp-m7vr-jfp6
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
2DescriptionCVE.org
Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop users organization-wide are exposed to a privilege escalation vulnerability (CVE-2026-13897, CVSS 8.8) in versions prior to 150.0.7871.47, which could allow attackers to escalate browser-level permissions if users visit a malicious page. No public exploit has been identified at time of analysis, but the vulnerability affects the vast majority of enterprise workstations and poses material risk to data confidentiality and system integrity. Vendor-released patching is available and should be deployed immediately.
Within 24 hours, assess your organization's Chrome deployment scale and identify systems that handle sensitive data or administrative functions, as privilege escalation on these assets poses the highest risk. Within 7 days, deploy Google Chrome version 150.0.7871.47 or later through your patch management system, prioritizing endpoints with elevated privileges or production access. Within 30 days, verify patch deployment across all Chrome installations, audit systems for any exploitation artifacts in browser logs, and update your vulnerability inventory to confirm full remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB