EUVD-2026-40750
GHSA-jhm7-5pwp-pw2x
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack is delivered via network traffic to a local-network Chromecast component, making AV:A more accurate than AV:L; no privileges required; user interaction needed; confidentiality-only impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
5DescriptionCVE.org
Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Out-of-bounds read in Chrome's Chromecast component allows a local attacker to leak sensitive contents from the browser's process memory by delivering malicious network traffic to the affected subsystem. Affected versions are all Chrome releases prior to 150.0.7871.47 on desktop platforms. No public exploit code or CISA KEV listing is identified at time of analysis, and Google's own severity rating is Low, though the CVSS confidentiality impact is scored High due to potential direct process memory exposure.
Technical ContextAI
The vulnerability resides in Chrome's Chromecast implementation (CWE-125: Out-of-Bounds Read), a network-facing component responsible for device discovery and media streaming via the Cast protocol. An out-of-bounds read occurs when the Chromecast subsystem processes crafted incoming network data without adequate bounds checking, causing memory at an offset beyond a buffer's allocated region to be read and potentially returned to the attacker. The CPE-equivalent affected product per EUVD is Chrome versions prior to 150.0.7871.47. CWE-125 root cause class typically arises from missing or incorrect length validation when indexing into a buffer, especially in parsers handling variable-length protocol messages such as those used by Cast protocol handshakes or stream negotiation.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, which resolves this vulnerability per the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch to most users automatically; administrators managing enterprise deployments should verify the update has applied via chrome://settings/help. As a compensating control where immediate upgrade is not feasible, disabling or restricting Chromecast functionality via enterprise policy (e.g., setting EnableMediaRouter to false) eliminates the attack surface entirely, though this removes Cast streaming capabilities. Network-level controls blocking local Cast protocol traffic (UDP port 8008-8009 range) can limit exposure in environments where Chromecast features are not needed, with the trade-off of breaking legitimate Cast device discovery.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today