EUVD-2026-50652
GHSA-6m4c-qhgh-r7qc
Severity by source
Sources disagree (Low–Critical)AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Adjacent vector confirmed by local-network-segment requirement; PR:N and UI:N because attacker sends malicious traffic without authentication or victim action; C:L and I:L reflect XSS impact confined to the injected page with no availability disruption.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML into a privileged page via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.
Technical ContextAI
The vulnerability is rooted in Google Chrome's Chromecast feature, which handles discovery and communication over the local network segment using proprietary Chromecast protocols. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome installations across platforms where Chromecast is present. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: Chrome's Chromecast subsystem fails to sufficiently sanitize or enforce content security policies on network-sourced data before rendering it, allowing attacker-crafted traffic to be interpreted as executable HTML or JavaScript within a privileged internal Chrome page. The 'privileged page' context suggests the injection target has elevated trust within the browser's origin model, amplifying the potential impact beyond a standard web-content XSS.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this insufficient policy enforcement. The stable channel release advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html confirms the fix. Enterprise administrators who cannot patch immediately should consider enforcing the ChromecastEnabled=false policy via Google Admin Console or Group Policy to disable the Chromecast component entirely, eliminating the attack surface at the cost of losing all cast functionality for managed devices. A second compensating control is network segmentation: placing Chrome users on isolated VLANs or enforcing 802.1X port-based access control reduces the pool of potential LAN-adjacent attackers, though it does not eliminate risk from trusted insiders or compromised devices on the same segment.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today