EUVD-2026-50798
GHSA-9rfm-7jrw-fvc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryExploit separate renderer bug for foothold
-
ExploitSend malformed input to Chromecast component
-
ExecutionBypass IPC input validation
-
PersistEscape sandbox into browser process
-
ImpactExecute code at higher privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (typically via a separate renderer RCE) - this CVE alone is not a standalone remote exploit but the sandbox-escape link in a chain. The vulnerable code path is the Chromecast/media-casting component, so the crafted input must reach that subsystem. UI:R means a victim must interact by visiting the attacker's crafted HTML page. Limiting factors: the renderer-compromise precondition sharply narrows practical exploitation (consistent with the 0.29% EPSS and no KEV listing), and only Chrome builds prior to 151.0.7922.72 are affected. Note the tension between the vendor vector's PR:N/AV:N and the description's explicit 'compromised the renderer process' prerequisite - verify with vendor if precise privilege modeling matters for your risk scoring. |
| Impact | Signals are mixed and must be read together. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects the full attractiveness of a sandbox escape (scope change, total C/I/A impact), but the description imposes a hard prerequisite the vector understates: the attacker must ALREADY have compromised the renderer process - this is a second-stage bug, not a standalone remote exploit. This tension explains the low EPSS (0.29%, 21st percentile) and the absence of KEV listing: real-world exploitation requires chaining with a separate renderer RCE, so mass exploitation is unlikely. SSVC-style reading: technical impact is total, but automatable exploitation is constrained by the renderer-compromise precondition. Net priority is high for patching (it completes an exploit chain and is trivially fixed by updating) but this is not an actively-mass-exploited emergency on its own. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer vulnerability to gain code execution inside Chrome's sandboxed renderer when a victim visits a malicious site. Using this CVE, the attacker then sends crafted, insufficiently-validated input to the Chromecast component to escape the sandbox and run code in the more-privileged browser process. No public exploit is identified at time of analysis; the crafted HTML page delivers the initial stage and the sandbox escape completes the chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Chromecast component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 due to scope change, it is a classic second-stage browser exploit chained after an initial renderer bug. No public exploit is identified at time of analysis and EPSS is low (0.29%), consistent with a bug requiring a prior renderer foothold rather than a single-shot drive-by.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72. Update Chrome to 151.0.7922.72 or later on all desktop platforms via the browser's built-in updater (Settings then About Chrome, followed by a relaunch) or enterprise deployment tooling, and restart the browser to apply the update, per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires an already-compromised renderer, interim compensating controls target the initial foothold and the vulnerable feature: keep site-isolation defenses default-enabled, and where Cast functionality is not needed disable or restrict the Chromecast/media-router feature (enterprise policy EnableMediaRouter=false) to shrink the attack surface, accepting the trade-off that users lose in-browser casting. Downstream Chromium browsers should be updated once their vendors ship the merged fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Chromecast/media-casting subsystem, which handles device discovery and content streaming between the browser and Cast receivers. Chrome enforces a multi-process security model where untrusted web content runs inside a low-privilege sandboxed renderer, and privileged operations must cross an IPC boundary to the more-trusted browser process. Classified as CWE-20 (Improper Input Validation), the root cause is insufficient validation of untrusted input crossing this boundary, so a message or data structure originating from a compromised renderer is trusted more than it should be, permitting escalation out of the sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all pre-151.0.7922.72 desktop builds.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Kept AV:N/UI:R/S:C with full impact for the sandbox escape, but raised AC:L to AC:H because exploitation depends on first compromising the renderer, a non-trivial precondition.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape in the Chromecast component (CVE-2026-17672, CVSS 9.6) that allows attackers who have compromised the renderer process to achieve full system compromise. This two-stage attack path affects all organizations using Chrome, with risk amplified in environments where targeted browser exploitation is a known threat vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB