EUVD-2026-34517
GHSA-cj5q-m4jx-3mh8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in the Cast component of Google Chrome (prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections via a crafted HTML page, requiring only that the target user visit the attacker-controlled page. The CVSS vector confirms high integrity impact with no confidentiality or availability consequence, indicating the attack allows unauthorized cross-origin writes or data manipulation rather than information disclosure. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) signals low observed exploitation interest despite the medium-severity Chromium classification.
Technical ContextAI
The vulnerability resides in Chrome's Cast subsystem - the component responsible for streaming content to Chromecast and Cast-enabled devices - and stems from CWE-20 (Improper Input Validation) where attacker-controlled input from a crafted HTML page is insufficiently validated before being processed. The Same-Origin Policy (SOP) is a foundational browser security boundary preventing scripts from one origin accessing resources of another; bypassing it enables cross-origin manipulation of content or state. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates this bypass specifically affects data integrity (I:H) without granting read access (C:N), consistent with a scenario where the Cast component permits cross-origin writes or spoofing. Affected product per EUVD: Google Chrome versions in the range below 149.0.7827.53.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should apply this automatically on restart; users can manually trigger the update via Chrome menu > Help > About Google Chrome. As a compensating control for environments where immediate updates are not feasible, disabling or restricting access to the Cast feature (via enterprise policy CastReceiverEnabled=false or equivalent) removes the vulnerable code path entirely, though this disables casting functionality. Organizations managing Chromium-based browsers (Edge, Brave, etc.) should check their respective vendors for equivalent patch availability, as the upstream fix may not yet be incorporated.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today