Google Chrome EUVD-2026-28117

Requires prior compromise of Chrome renderer process through a separate vulnerability - this is NOT a standalone remote exploit. Attack complexity is high (AC:H) because attacker must: (1) successfully exploit a different Chrome bug to gain renderer access, (2) craft specific Cast API calls that trigger the validation flaw, and (3) overcome any additional runtime protections like ASLR/DEP during privilege escalation. User interaction required (UI:R) for initial renderer compromise (victim must visit attacker-controlled page). Exploitation does NOT require Cast feature to be actively in use or Chromecast devices to be present - the vulnerable code paths exist in Chrome's standard build. No special Chrome configuration or flags needed beyond default installation. Privilege escalation component itself (after renderer compromise) requires no additional authentication (PR:N from already-compromised context).

Real-world risk is moderate despite high CVSS score. CVSS rates this 7.5 based on network attack vector with high confidentiality, integrity, and availability impact, but AC:H (high attack complexity) and UI:R (user interaction required) significantly constrain exploitation. Critically, this requires PRE-COMPROMISE of the renderer process, meaning attackers must first exploit a separate vulnerability to gain initial access - this is a post-exploitation privilege escalation, not a standalone attack. Chromium security team's Low severity rating acknowledges this prerequisite and Chrome's layered security model. No EPSS data, KEV listing, or public POC identified, suggesting purely theoretical risk at analysis time. SSVC framework would likely classify this as Defer priority: requires chained exploitation (not automatable alone), impacts only sandboxed browser context (not system-level), and no evidence of active exploitation. Security teams should prioritize patching as part of normal Chrome update cycles rather than emergency response, unless operating in high-threat environments where renderer compromises are actively observed.

Attacker first exploits a separate Chrome vulnerability (e.g., memory corruption in JavaScript engine) to compromise the renderer process while victim browses a malicious website. From compromised renderer, attacker crafts specially malformed Cast protocol messages or HTML5 Cast API calls exploiting insufficient input validation in the browser process's Cast handler. This allows code execution at browser process privilege level, escaping the renderer sandbox. Attacker can then access cookies, saved passwords, and other browser-stored credentials across all tabs, install persistent extensions, or pivot to system-level compromise through browser process privileges.