EUVD-2026-50593
GHSA-c3wg-xg36-wxvj
Severity by source
Sources disagree (Medium–Critical)AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent network vector reflects Cast protocol's LAN-only scope; C:L only as impact is cross-origin data leakage with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.
Technical ContextAI
The affected component is the Cast subsystem in Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which implements Google's screen and audio casting protocol allowing Chrome to communicate with Chromecast and similar devices over local networks. CWE-20 (Improper Input Validation) is the root cause class: the Cast component fails to adequately validate untrusted data arriving via network traffic, allowing a locally adjacent attacker to send specially crafted Cast protocol messages that cause the browser to expose data across origin boundaries. Cross-origin leaks of this kind typically exploit gaps in the Same-Origin Policy enforcement - where data from one web origin becomes observable to another - through a side-channel or inadvertent disclosure triggered by the malformed input. The vulnerability is classified as Medium severity by the Chromium security team, consistent with its limited confidentiality-only impact and adjacency constraint.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators who cannot immediately deploy the update should consider disabling the Cast feature via Chrome enterprise policy (e.g., setting EnableMediaRouter to false or restricting Cast via Google Admin Console), which removes the vulnerable component's exposure entirely but disables Chromecast and related casting functionality as a trade-off. Organizations should ensure that client systems are not exposed to untrusted network adjacency - enforcing client isolation on Wi-Fi networks (AP isolation) and proper VLAN segmentation reduces the attack surface in the interim. Auto-update should be verified as enabled for managed fleets.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today