Google Chrome EUVD-2026-50652

Exploitation requires the attacker to be physically or logically adjacent to the victim on the same local network segment (e.g., shared Wi-Fi access point, corporate LAN, or VPN subnet) - this is the primary limiting condition established by AV:A in the CVSS vector. The victim must be running Google Chrome prior to 151.0.7922.72 with the Chromecast feature active and discoverable on the network. No authentication is required from the CVSS vector (PR:N) and no victim interaction is needed (UI:N) once adjacency is established. Exploitation is limited to the injected page context (S:U) and does not directly compromise the underlying OS. The requirement for local network adjacency excludes remote internet-based attackers entirely, and the absence of a public POC further limits exploitation to adversaries capable of developing custom Chromecast protocol tooling.

The CVSS 5.4 Medium score with AV:A is the single most important limiting signal: exploitation is restricted to attackers already on the same local network segment as the victim, ruling out direct internet-based mass exploitation and substantially narrowing the realistic attacker pool to co-located users on shared Wi-Fi, corporate LAN, or VPN segments. AC:L, PR:N, and UI:N indicate that once adjacency is achieved, no authentication, special configuration, or victim action is required. However, the EPSS score of 0.11% (2nd percentile) strongly corroborates that no automated or widespread exploitation tooling exists. There is no CISA KEV listing and no known POC. The S:U (scope unchanged) and limited C:L/I:L impact cap the worst-case outcome to partial data exposure and page integrity compromise within the injected page - not OS-level takeover. Real-world prioritization should be moderate: patch promptly as part of routine Chrome update cycles, but this is not an emergency out-of-band patching scenario for most organizations. Environments with open or untrusted Wi-Fi (hotels, airports, coworking spaces) face meaningfully higher realistic risk.

An attacker connected to the same Wi-Fi network as a victim running Chrome with Chromecast enabled crafts and transmits malicious network packets mimicking Chromecast protocol traffic. Chrome's insufficient policy enforcement causes the injected HTML or JavaScript payload to render and execute within a privileged internal Chrome page, potentially exposing page-level data or altering displayed content. No public exploit code is known at time of analysis, making opportunistic exploitation unlikely without bespoke tooling.