EUVD-2026-40576
GHSA-p56f-xpc2-m48c
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory prior renderer compromise; UI:R for crafted page; C:H for memory disclosure; I:N/A:N as only confidentiality is impacted with no scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in the Chromecast component of Google Chrome prior to 150.0.7871.47 enables a remote attacker, who has already achieved renderer process compromise, to exfiltrate potentially sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - it cannot be exploited in isolation and requires a prior renderer compromise as a prerequisite. Google has released a patch in Chrome 150.0.7871.47; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability (CWE-125: Out-of-Bounds Read) resides in Chrome's Chromecast integration component, which handles IPC and media casting logic within the renderer process. An out-of-bounds read occurs when the Chromecast code processes attacker-controlled data from a crafted HTML page without proper bounds checking, causing the read pointer to advance beyond the allocated buffer and expose adjacent memory contents. The affected product is Google Chrome across desktop platforms, all versions prior to 150.0.7871.47 as confirmed by EUVD-2026-40576. The Chromecast subsystem runs within the sandboxed renderer, so exploitation yields memory contents scoped to that process, not the broader OS. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-reachable but complexity-gated attack with no integrity or availability impact.
RemediationAI
The primary fix is to update Google Chrome to version 150.0.7871.47 or later, as documented in the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch to most endpoints without manual intervention; administrators managing enterprise fleets should verify deployment via Google Admin or endpoint management tooling. As a compensating control prior to patching, organizations can disable or restrict Chromecast/casting functionality via Chrome enterprise policy (CastReceiverEnabled set to false), which removes the vulnerable code path - this has the trade-off of disabling all Chromecast casting features for affected users. Because exploitation requires a pre-existing renderer compromise, enforcing Chrome's site isolation and strict sandbox policies (already default in modern Chrome) meaningfully raises the bar for the prerequisite stage of an exploit chain.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today