Google Chrome EUVD-2026-34720

The Chrome Cast feature must be present in the browser - it is enabled by default in standard desktop Chrome installations, so no special configuration is required on the victim's side. Exploitation requires the victim user to actively navigate to or be redirected to an attacker-controlled HTML page (UI:R per CVSS vector); the attacker cannot exploit this passively without some form of user interaction or social engineering. The CVSS PR:N confirms no attacker-side authentication is needed. Exploitation is limited to Chrome desktop versions strictly prior to 149.0.7827.53; updated browsers are not affected. The impact ceiling is limited to low-severity cross-origin integrity writes with no confidentiality exposure, constraining the practical damage even in a successful exploitation scenario.

The CVSS base score of 4.3 (Medium) is internally consistent: a network-reachable, zero-authentication SOP bypass is partially offset by the mandatory user interaction (UI:R), scope unchanged (S:U), and impact limited exclusively to low integrity (I:L) with zero confidentiality or availability effect. The EPSS probability of 0.02% at the 6th percentile is strikingly low and aligns with Google's own 'Low' Chromium security severity rating, strongly suggesting this vulnerability is not being actively targeted in automated or commodity exploitation campaigns. This is not a CISA KEV entry and no POC code has been identified, reinforcing the low-priority posture. For most organizations, the practical risk is limited: exploitation requires convincing a user to visit a malicious page, and the resulting cross-origin write capability is narrow in scope. While SOP bypasses can serve as a stepping stone in multi-stage attack chains, the absence of confidentiality impact and the required user interaction make standalone exploitation low-consequence. This should be treated as a routine patch cycle update rather than an emergency response item.

An attacker hosts a crafted HTML page that delivers malformed or manipulated input to Chrome's Cast component, causing the browser to incorrectly permit a cross-origin write operation that the same-origin policy should block. The attacker must social-engineer the victim into visiting the malicious page using an unpatched Chrome browser, for instance via phishing email or malicious advertisement redirect. No public exploit code has been identified, and the low EPSS score suggests this scenario has not been operationalized by threat actors at time of analysis.