EUVD-2026-40628
GHSA-3m3v-363x-rf9h
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:A confirmed by Cast's local-network-only protocol scope; PR:N as no credentials are needed to send Cast traffic; C:H for uninitialized memory leakage; I:N and A:N as no write or availability impact exists.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
Technical ContextAI
Chrome's Cast subsystem implements the Google Cast protocol used for device discovery and media streaming to Chromecast and compatible receivers over the local network. CWE-457 (Use of Uninitialized Variable) arises when memory is allocated but not initialized before its contents are consumed or transmitted; in a network-facing component, this can expose whatever bytes previously occupied that memory region to an external party. Because Cast operates exclusively over the local network segment, the CVSS attack vector is correctly classified as AV:A (Adjacent), not network-wide. All Chrome desktop releases prior to 150.0.7871.47 are affected per the EUVD-2026-40628 record and Google's Stable Channel advisory. The Chromium bug tracker entry is https://issues.chromium.org/issues/513158425, which may be access-restricted pending fuller disclosure.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, as documented in Google's Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this fix automatically for most users; verify the installed version at chrome://settings/help. For environments where immediate patching is not feasible, disabling the Cast/Media Router feature via the enterprise policy MediaRouterEnabled=false or the flag chrome://flags/#load-media-router-component-extension removes the vulnerable attack surface entirely, with the trade-off that Chromecast streaming and Cast tab functionality will be unavailable. Additionally, enforcing Wi-Fi client isolation on access points prevents station-to-station traffic, reducing adjacency-based attack exposure without affecting browser functionality - though this is a network-layer control and does not address the underlying flaw.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today