EUVD-2026-50593
GHSA-c3wg-xg36-wxvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish local network adjacency
-
DeliveryCraft malicious Cast protocol traffic
-
ExploitDeliver crafted packets to victim Chrome instance
-
ExecutionTrigger insufficient validation in Cast component
-
PersistForce cross-origin data disclosure
-
ImpactExfiltrate leaked data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to be on the same local network segment as the target Chrome user (AV:A) - this is the primary limiting condition. Specifically, the attacker must share a broadcast domain, LAN, or Wi-Fi segment with the victim; remote internet-based attackers cannot exploit this vulnerability without first achieving network adjacency through other means. The Cast feature must be present and operational in Chrome, which is enabled by default in standard Chrome installations. No victim authentication, user interaction, or elevated privileges are required (PR:N, UI:N). Exploitation is further limited by the narrow impact: only cross-origin data confidentiality is affected (C:L), with no write or availability impact. Non-default network segmentation (AP client isolation, VLAN separation) effectively blocks exploitation even without patching. |
| Impact | The CVSS 4.3 (Medium) rating is well-calibrated for this issue. The adjacent network vector (AV:A) is the most significant limiting factor: exploitation is physically constrained to attackers sharing a LAN segment, broadcast domain, or Wi-Fi network with the victim, eliminating remote internet-based exploitation. The lack of required privileges (PR:N) and user interaction (UI:N) means that once network adjacency is achieved, exploitation requires no victim cooperation. Impact is strictly confidentiality-partial (C:L) with no integrity or availability consequences. EPSS at 0.12% (2nd percentile) independently corroborates low exploitation likelihood, consistent with the adjacency barrier and Medium classification. No POC exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. In enterprise environments with proper network segmentation, the realistic attack surface is narrow. The primary risk scenario involves shared or untrusted networks such as public Wi-Fi, guest LANs, or insufficiently segmented corporate networks. |
| Exploit ScenarioDerived | An attacker connected to the same Wi-Fi network or LAN segment as a Chrome user - for example, on a shared corporate guest network or public hotspot - crafts and transmits malicious Cast protocol network traffic toward the victim's Chrome browser. The insufficient validation in Chrome's Cast component processes the malformed packets and inadvertently exposes cross-origin data from the victim's active browsing session, potentially revealing authentication tokens, page content, or other sensitive information from origins the victim is accessing. No public exploit code has been identified at time of analysis, and the adjacent network requirement limits opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators who cannot immediately deploy the update should consider disabling the Cast feature via Chrome enterprise policy (e.g., setting EnableMediaRouter to false or restricting Cast via Google Admin Console), which removes the vulnerable component's exposure entirely but disables Chromecast and related casting functionality as a trade-off. Organizations should ensure that client systems are not exposed to untrusted network adjacency - enforcing client isolation on Wi-Fi networks (AP isolation) and proper VLAN segmentation reduces the attack surface in the interim. Auto-update should be verified as enabled for managed fleets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Cast subsystem in Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which implements Google's screen and audio casting protocol allowing Chrome to communicate with Chromecast and similar devices over local networks. CWE-20 (Improper Input Validation) is the root cause class: the Cast component fails to adequately validate untrusted data arriving via network traffic, allowing a locally adjacent attacker to send specially crafted Cast protocol messages that cause the browser to expose data across origin boundaries. Cross-origin leaks of this kind typically exploit gaps in the Same-Origin Policy enforcement - where data from one web origin becomes observable to another - through a side-channel or inadvertent disclosure triggered by the malformed input. The vulnerability is classified as Medium severity by the Chromium security team, consistent with its limited confidentiality-only impact and adjacency constraint.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent network vector reflects Cast protocol's LAN-only scope; C:L only as impact is cross-origin data leakage with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB