EUVD-2026-28113Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:A confirmed by local-network-segment requirement; PR:N and UI:N as Cast listener is passive; C:L only with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to bypass same origin policy via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in Google Chrome's Cast feature prior to version 148.0.7778.96 enables a network-adjacent unauthenticated attacker to read limited cross-origin browser data via crafted network traffic. The vulnerability stems from insufficient input validation in the Cast subsystem (CWE-20), and is constrained to attackers sharing the same local network segment as the victim. No active exploitation has been confirmed - the issue is absent from CISA KEV, EPSS sits at 0.01% (1st percentile), and SSVC assesses exploitation status as none - making this a low-priority patching item outside of high-risk shared network environments. Google has released a fix in Chrome 148.0.7778.96.
Technical ContextAI
Google Chrome's Cast feature implements the Google Cast protocol, which continuously listens on the local network to discover and communicate with Cast-enabled devices (Chromecast, smart TVs, etc.). The root cause is CWE-20 (Improper Input Validation): the Cast subsystem fails to adequately validate untrusted network-layer input, allowing a rogue device or crafted packet on the same LAN segment to manipulate Chrome's origin-trust decisions. The same-origin policy (SOP) is a foundational browser security boundary preventing scripts from one web origin accessing resources belonging to another; bypassing it via the Cast listener channel can expose cookies, session state, or page content from other origins loaded in the browser. Affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome builds prior to 148.0.7778.96.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later, which resolves this vulnerability per the stable channel desktop release advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this version automatically in most configurations; administrators managing enterprise fleets should verify rollout via policy. Red Hat and SUSE users should monitor their respective security errata channels for distribution-level Chromium package updates. As a compensating control for users on untrusted networks prior to patching, the Cast feature can be disabled in Chrome settings (navigate to chrome://settings, search for 'Cast', and disable 'Show cast option in the media controls and toolbar') - this eliminates the vulnerable attack surface entirely, with the trade-off of preventing media casting to Chromecast and other Cast-enabled devices. Network-level controls that restrict inbound traffic to Cast listener ports can also reduce exposure on managed networks.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today