EUVD-2026-50722
GHSA-789q-pc44-64xf
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), victim must actively visit it (UI:R), no attacker privileges required (PR:N), impact is limited cross-origin data disclosure only (C:L, I:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.
Technical ContextAI
The vulnerability originates in Chrome's Cast component - the browser subsystem that powers Google Cast and Chromecast streaming functionality. CWE-20 (Improper Input Validation) identifies the root cause as insufficient sanitization of attacker-controlled input derived from a crafted HTML page before it is processed by the Cast subsystem, resulting in a same-origin policy bypass. The CPE identifier cpe:2.3:a:google:chrome applies broadly across Chrome desktop installations. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms the flaw is network-reachable with low complexity, no privilege requirement, but requires user interaction (the victim navigating to the malicious page), and produces limited confidentiality impact with no effect on integrity or availability.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirming the fix, as detailed in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default for consumer installations, but enterprise administrators should verify deployment via fleet management tools (e.g., Google Admin Console, Intune, or endpoint management platforms) to confirm the patched version is applied across managed devices. As a targeted compensating control where immediate patching is not feasible, organizations can disable the Cast feature via the Chrome enterprise policy EnableMediaRouter set to false; this eliminates the Cast attack surface entirely but disables all Chromecast and Google Cast streaming functionality, which may impact productivity in environments that rely on screen casting. No other workarounds are identified that partially mitigate the vulnerability without removing Cast access.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today