EUVD-2026-40586
GHSA-4qhg-7v4f-qrrf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the explicit prerequisite of a pre-compromised renderer process; AV:N and UI:R retained as delivery is network-based via crafted HTML requiring user interaction.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's Chromecast implementation (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to circumvent navigation restrictions via a specially crafted HTML page. This is a post-compromise escalation primitive rather than a standalone entry point - the renderer must already be under attacker control, making this a link in an exploit chain rather than an initial access vector. No public exploit has been identified at time of analysis; EPSS at 0.23% (14th percentile) reflects very low observed exploitation probability, consistent with the chained-exploit requirement.
Technical ContextAI
The vulnerability resides in Chrome's Chromecast subsystem - the browser component responsible for casting web content to Google Cast-enabled devices - and is classified under CWE-20 (Improper Input Validation). The root cause is an inappropriate implementation within the Chromecast code path that fails to properly enforce navigation restrictions when inputs originate from a compromised renderer process. In Chrome's multi-process architecture, the renderer process is sandboxed and subject to strict navigation policies enforced by the browser process; a flaw in how the Chromecast integration validates or routes navigation requests can allow a compromised renderer to bypass those boundaries. Affected versions are Google Chrome desktop releases prior to 150.0.7871.47 across supported platforms, as confirmed by the EUVD affected-version range.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later immediately via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise deployment tooling. The vendor advisory confirming the fix is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because this vulnerability requires a pre-compromised renderer process to exploit, organizations that cannot immediately patch should prioritize mitigating initial renderer compromise vectors (e.g., ensuring all other Chrome CVEs in the same release are patched and that Site Isolation is enabled). Disabling Chromecast/cast functionality via enterprise policy (CastEnabled=false) would remove the vulnerable code path entirely as a compensating control, with the trade-off of disabling all casting features for affected users.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today