EUVD-2026-34601
GHSA-wwcx-35p9-p479
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in the Chromecast component of Google Chrome prior to version 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to leak potentially sensitive data from process memory by delivering a crafted HTML page. This is a chained vulnerability: exploitation is conditional on a prior renderer compromise, making it a second-stage information-disclosure step rather than a standalone attack. No public exploit code has been identified and EPSS probability stands at 0.05% (15th percentile), consistent with a medium-severity, constrained attack path. Google has released a fix in stable channel 149.0.7827.53.
Technical ContextAI
The vulnerability resides in the Chromecast subsystem of Google Chrome's renderer-side code. CWE-20 (Improper Input Validation) is the assigned root cause class, meaning attacker-controlled input is not properly validated before being used to index or access memory, resulting in a read beyond an allocated buffer boundary - consistent with the 'out of bounds read' description and the 'Buffer Overflow' tag applied by ENISA EUVD-2026-34601. Chrome's multi-process architecture places rendering in a sandboxed renderer process; however, this vulnerability is meaningful only after that sandbox has been breached by a prior exploit. Affected versions are all Google Chrome releases prior to 149.0.7827.53 across desktop platforms, as confirmed by the EUVD affected-version range and the Google Chrome Releases stable channel advisory.
RemediationAI
The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise environments using managed Chrome deployments should push this update via policy as part of standard patch cycles. Because exploitation requires a prior renderer compromise, organizations that cannot immediately patch should focus on reducing renderer attack surface: enforce Chrome's strict site isolation (--site-per-process, which is default on desktop but verify it is not disabled by policy), disable unnecessary browser extensions that expand attack surface, and restrict browsing to trusted content through URL filtering or proxy allowlists. Blocking access to untrusted or unknown web content is the most effective compensating control given the UI:R requirement and the renderer-compromise prerequisite, though it carries usability trade-offs. No workaround fully replaces patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today