EUVD-2026-50747
GHSA-jvq6-g9p8-pjjw
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible with no privileges; user must visit crafted page (UI:R); impact is partial cross-origin read only, with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.
Technical ContextAI
The Cast feature in Google Chrome manages streaming of browser content to Google Cast-compatible devices (e.g., Chromecast). CWE-346 (Origin Validation Error) indicates the implementation fails to correctly validate or enforce same-origin constraints during Cast-related operations, allowing a malicious page to initiate or observe Cast interactions in a way that exposes data belonging to a different origin. The affected product is confirmed via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/514460133) is the upstream bug report, though access may be restricted. The root-cause class (origin validation failure) is consistent with how Cast integrates with the renderer process and may involve improper message-passing or resource-access checks across origins.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or enterprise deployment tools. The vendor-released patch is documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For environments where immediate patching is not possible, disabling or restricting the Cast feature via enterprise policy (e.g., setting the EnableMediaRouter policy to false) removes the vulnerable code path, though this eliminates Chromecast/Cast functionality entirely. No other confirmed workarounds are available. Given the low EPSS and absence of active exploitation, standard patch-cycle deployment is appropriate for most organizations.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today