EUVD-2026-50601
GHSA-2pp4-fggf-q8fx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryLures victim to page via phishing or malvertising
-
ExploitPage triggers Media Router origin validation flaw
-
ExecutionSame-origin policy restriction bypassed
-
ImpactAttacker manipulates cross-origin media or casting state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires the victim to actively visit an attacker-controlled HTML page in an unpatched Chrome browser (UI:R); no authentication or special configuration of the victim's system is required beyond using a vulnerable Chrome version. The CVSS PR:N confirms no attacker-side privileges are needed. The primary limiting factor is the mandatory user interaction - drive-by exploitation without any user navigation is not possible given UI:R. The Media Router feature is enabled by default in Chrome desktop builds, so no non-default configuration is required on the victim side. Exploitation is limited to integrity impacts (I:H); there is no observed confidentiality or availability impact, and the attack does not escape the browser sandbox to affect the host OS (S:U). |
| Impact | The CVSS 3.1 score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:R - network-reachable, low complexity, no attacker privileges required, but requiring a user to visit a crafted page. The high integrity impact (I:H) with no confidentiality or availability impact (C:N/A:N) suggests the exploit enables cross-origin writes or privileged Media Router actions rather than data exfiltration. Scope is Unchanged (S:U), meaning exploitation does not escape the browser's security boundary to affect the underlying OS. Against these CVSS signals, EPSS at 0.23% (14th percentile) indicates negligible observed exploitation probability in the near term, and the absence of both a CISA KEV entry and any public POC further reduces urgency. The primary real-world risk is to users whose browsers interact with Media Router-enabled environments (corporate casting infrastructure, smart displays), where a malicious page could manipulate casting sessions or cross-origin media state. This is a meaningful but not critical priority: patch promptly during the normal update cycle, but emergency out-of-band patching is not warranted based on current threat signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that abuses the Media Router's insufficient origin validation to issue cross-origin requests or trigger Media Router actions on behalf of a foreign origin. A targeted user is directed to this page - via phishing link, malicious advertisement, or compromised site - and upon page load the attacker's script silently violates same-origin policy through the vulnerable Media Router interface, potentially hijacking or manipulating an active casting session or cross-origin media state. No public proof-of-concept is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most desktop Chrome installations update automatically; administrators managing enterprise fleets should verify rollout via Google Admin Console or equivalent MDM tooling. As a compensating control pending patch deployment, organizations may consider disabling or restricting access to Media Router features via Chrome enterprise policy (e.g., EnableMediaRouter=false), though this will disable Chromecast and related casting functionality - a trade-off relevant only for environments that do not rely on media casting. Restricting users to known-safe browsing lists via web proxy can reduce exposure to crafted attacker-controlled pages but is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Media Router subsystem, the component responsible for facilitating communication with cast-compatible devices (e.g., Chromecast endpoints) and handling media routing requests across browser contexts. CWE-346 (Origin Validation Error) identifies the root cause class: the implementation fails to properly validate the origin of requests or messages processed by the Media Router, allowing a cross-origin HTML page to issue interactions that should be restricted to the same-origin context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop installations prior to the fixed build are in scope. This class of flaw is consistent with browser IPC or Mojo interface misuse, where insufficient origin checks on privileged browser-process-side handlers allow renderer-process content from a foreign origin to trigger protected operations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page (AV:N), no privileges needed (PR:N), user navigation required (UI:R); Media Router flaw enables cross-origin integrity violation but not data disclosure or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB