EUVD-2026-50674
GHSA-5xwc-mhxp-fxvm
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
SOP bypass crosses origin boundaries warranting S:C; user interaction required (UI:R); no confidentiality or availability impact; PR:N as no attacker authentication is needed.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.
Technical ContextAI
The Cast feature in Google Chrome for Android enables media streaming from the browser to Cast-compatible devices such as Chromecast hardware. CWE-346 (Origin Validation Error) identifies the root cause as a failure to properly enforce the browser's same-origin policy within Cast's implementation - allowing a crafted page from one origin to affect resources or state belonging to a different origin. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome application broadly, but the description explicitly scopes the vulnerability to Android deployments prior to version 151.0.7922.72. Desktop Chrome is not listed as affected. The Chromium issue tracker reference (issues.chromium.org/issues/513719671) is not publicly accessible, so the precise internal mechanism of the origin validation failure is unconfirmed beyond the public description.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, which contains the vendor-released patch per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome on Android typically updates automatically via the Google Play Store; administrators managing enterprise Android fleets should verify deployment of the updated version through their MDM solution. As a temporary compensating control for environments that cannot immediately update, disabling the Cast feature via Chrome's enterprise policy (CastReceiverEnabled=false or equivalent) eliminates the vulnerable code path but removes media-streaming functionality - a meaningful trade-off for users relying on Chromecast. Restricting access to untrusted or unvetted web pages via web filtering also reduces exposure by limiting the attacker's delivery vector, since exploitation requires the user to visit a crafted HTML page.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today