EUVD-2026-40735
GHSA-4q4m-59wq-c877
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:A confirmed by local-network-segment requirement; PR:N and UI:N per unauthenticated passive trigger; C:H for process memory disclosure; I:N and A:N per description.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)
AnalysisAI
Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be present on the same local network segment (Layer 2 adjacency - same subnet, VLAN, or Wi-Fi access point) as the victim. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a moderate-severity but position-constrained vulnerability: exploitation requires the attacker to share the same local network segment as the victim, which substantially limits the attack surface compared to internet-facing flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positions a rogue device - such as a laptop or Raspberry Pi running a spoofed Chromecast responder - on the same Wi-Fi network as a victim running an unpatched Chrome browser. When Chrome's Chromecast subsystem performs device discovery or initiates a casting session with the malicious device, the crafted response triggers a use-after-free condition in Chrome's process. … |
| Remediation | Update Google Chrome to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today