EUVD-2026-40570
GHSA-4pmm-4ff4-v6hc
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Cast traffic requires adjacent-network position (AV:A) with no auth or interaction; a heap overflow yielding code execution gives full C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Technical ContextAI
The vulnerability lives in Chrome's Chromecast (Cast) subsystem, which handles device discovery and media-streaming session negotiation over the local network. CWE-122 (heap-based buffer overflow) here stems from an integer overflow: a length or size value derived from attacker-controlled network data wraps around, leading to an undersized heap allocation followed by an out-of-bounds write. Corrupting adjacent heap metadata or object pointers in Chrome's renderer/browser process memory is the classic primitive that enables control-flow hijack and code execution. Because Cast operates on data received from the network rather than page content, the attack surface is the streaming/discovery protocol parser rather than the JavaScript engine.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable Channel Update; most installations receive this through Chrome's automatic updater, so ensure auto-update is enabled and restart the browser to apply it (verify via chrome://settings/help). See the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and issue https://issues.chromium.org/issues/500077014. As a compensating control until patched, restrict exposure to the Cast attack surface: disable Chromecast/Media Router (set the MediaRouterEnable / EnableMediaRouter enterprise policy to false, or block the cast:// feature), which prevents discovery/streaming traffic from reaching the vulnerable parser at the cost of losing Cast-to-device functionality. Additionally, isolate untrusted devices from user segments and block mDNS/Cast discovery ports (UDP 5353 and Cast TCP 8008/8009/8443) at network boundaries to reduce adjacent-network reachability, accepting that this breaks legitimate casting on those segments.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today