What is the CVSS score of CVE-2026-16416?

CVE-2026-16416 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-16416?

A critical sandbox escape vulnerability in Google Chrome's Chromecast component (CVE-2026-16416) could allow attackers with local system access to bypass browser security isolation and directly…. A patch is available.

How to fix or mitigate CVE-2026-16416?

Within 24 hours, identify all Chrome installations across your organization and flag systems where local users have privileged access or handle sensitive data. Within 7 days, deploy Google Chrome version 150.0.7871.182 or later enterprise-wide through your endpoint management system, prioritizing developer workstations and administrative terminals. Within 30 days, complete a full compliance audit using your device management tools to verify patch deployment across your entire user base and implement version-pinning policies to prevent fallback to vulnerable releases.

Google Chrome CVE-2026-16416

EUVD-2026-47571 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-21 chrome-cve-admin@google.com

GHSA-fp8j-cv93-rg46

Buffer Overflow Google Integer Overflow Suse

9.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.3 CRITICAL

Local vector because exploitation needs an in-sandbox foothold (AV:L); no added privileges within the compromised renderer (PR:N); sandbox escape crosses a trust boundary so S:C with full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

Jul 30, 2026 - 19:22 NVD

8.3 (HIGH) 9.3 (CRITICAL)

Analysis Generated

Jul 26, 2026 - 12:01 vuln.today

CVSS changed

Jul 24, 2026 - 13:22 NVD

8.3 (HIGH)

CVE Published

Jul 21, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Sandbox escape in the Chromecast component of Google Chrome before 150.0.7871.182 lets a local attacker corrupt memory through an integer overflow (CWE-190) triggered by crafted network traffic, potentially breaking out of the renderer sandbox to gain broader access on the host. Google rated the Chromium severity High, and the CVSS score is 9.3 driven by the scope change from a sandbox escape. There is no public exploit identified at time of analysis, EPSS exploitation probability is very low (0.10%), and CISA SSVC marks exploitation as none.

Technical ContextAI

The flaw lives in Chrome's Chromecast (Cast) subsystem, which handles device discovery and media streaming to Chromecast/Cast-enabled receivers and processes incoming network data as part of the casting protocol. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation on attacker-influenced size or length values wraps past the maximum representable value, producing an undersized allocation or miscalculated bounds that leads to out-of-bounds memory access - consistent with the 'Buffer Overflow' tag accompanying the integer-overflow classification. Because the affected code runs inside the Chrome renderer/sandbox boundary, a successful overflow can be leveraged as a sandbox escape rather than a simple crash. The single CPE provided (cpe:2.3:a:google:chrome) scopes this to the Chrome desktop browser rather than a standalone Chromecast hardware device.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.182 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html); most installations auto-update, so verify the version under chrome://settings/help and relaunch to apply. In managed fleets, push the updated build through your enterprise update policy and confirm minimum-version enforcement. Where immediate patching is not possible, a targeted compensating control is to disable or restrict the Cast/Chromecast feature and block outbound/inbound mDNS and Cast discovery traffic (UDP 5353 and the SSDP/Cast ports) at the network layer to reduce reachability of the vulnerable Cast parser - the trade-off is loss of casting functionality for users and possible disruption to legitimate media-streaming workflows. Chromium-based browsers (Edge, Brave, etc.) should be updated to builds incorporating the corresponding upstream fix.