EUVD-2026-40735
GHSA-4q4m-59wq-c877
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:A confirmed by local-network-segment requirement; PR:N and UI:N per unauthenticated passive trigger; C:H for process memory disclosure; I:N and A:N per description.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)
AnalysisAI
Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. No public exploit or CISA KEV listing is identified at time of analysis, and Google has released a patch in the stable channel.
Technical ContextAI
CWE-416 (Use After Free) occurs when heap memory is accessed after it has been freed, allowing an attacker to influence what data occupies that memory region and subsequently read or corrupt it. In this case, the vulnerable component is Chrome's Chromecast subsystem - the functionality enabling tab/screen casting to Chromecast-compatible devices on the local network. The adjacent-network attack vector (AV:A) indicates the vulnerability is exercised over the local network segment, consistent with Chromecast's mDNS/DIAL-based device discovery protocol operating over LAN. The 'malicious peripheral' phrasing suggests a rogue device on the local network (e.g., a spoofed Chromecast receiver) can trigger the UAF condition during the casting handshake or device enumeration phase, causing Chrome to read stale heap memory and disclose its contents. Affected CPE: Chrome prior to 150.0.7871.47.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing fleet deployments should verify update propagation. As a compensating control, users on untrusted or shared networks (guest Wi-Fi, public hotspots) can disable the Chromecast/casting feature in Chrome settings or via enterprise policy (CastEnabled=false) to eliminate the vulnerable attack surface until patching is complete; note that this disables all casting functionality. Restricting Chrome's network access to known trusted segments via host-based firewall rules is a secondary option but introduces operational complexity.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today