Google Chrome EUVD-2026-40802

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a prior-stage exploit is a hard prerequisite, per the description), and then delivers a crafted HTML page that exercises Chrome's Cast component - so the Cast/media-routing code path must be reachable. Limiting factors: the CVSS vector marks AC:H (non-trivial conditions/timing) and UI:R (the victim must load attacker-controlled content), and Chromium rates this Low severity. It is not remote-unauthenticated against a default browser in isolation; it only escalates privilege for an attacker who already holds renderer-level code execution.

Signals point to a real but conditional, low-urgency issue. The CVSS base score of 7.5 is driven by high C/I/A impact, but the vector itself (AV:N/AC:H/PR:N/UI:R) encodes high attack complexity and required user interaction, and the description adds a hard precondition: the attacker must already control the renderer process. Chromium's own severity rating is Low, and EPSS is 0.18% (8th percentile) - consistent with no mass-exploitation pressure. It is not on CISA KEV and no public exploit is identified, so this is not a drop-everything item. The main caveat: the 7.5 CVSS overstates standalone risk because it does not reflect the 'renderer already compromised' chaining requirement - treat this as a component of an exploit chain, not an independent RCE.

An attacker first compromises the Chrome renderer through a separate memory-corruption or logic bug (a common first stage), then serves a crafted HTML page that feeds malformed input into the Cast component; the browser process mishandles this input and grants the attacker elevated privileges beyond the renderer sandbox. Because AC is High and user interaction is required, the victim must load attacker-controlled content and the exploit is unreliable. No public proof-of-concept is identified at time of analysis.