Google Chrome EUVD-2026-50908

Victim must be running Google Chrome prior to 151.0.7922.72 and must actively navigate to (or be redirected to) an attacker-controlled HTML page - user interaction is confirmed required by the CVSS UI:R metric. The Cast feature must be present in the browser, which it is by default in all standard Chrome installations. Exploitation does not require any authentication or pre-existing access (PR:N per CVSS vector). Limiting factors: the attack is bounded to limited integrity violations only (I:L) with no confidentiality or availability impact (C:N, A:N) and no scope change (S:U), meaning the attacker cannot read cross-origin data or execute code - only perform constrained cross-origin writes or manipulations within the Cast processing context. The mandatory user interaction (visiting a malicious page) prevents fully automated or drive-by-passive exploitation.

All available signals consistently point to low real-world priority. The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a network-reachable, low-complexity attack that nonetheless requires user interaction (visiting a malicious page), produces only limited integrity impact, and causes no confidentiality or availability harm with no scope change. EPSS at 0.18% (8th percentile) places exploitation probability in the bottom decile of tracked CVEs. There is no CISA KEV listing, no public POC identified, and Chromium's own severity classification is 'Low' - an internal signal from the team with full access to the bug details (Chromium issue 519735808). No conflicting signals are present; this is a consistent, low-risk picture. Standard patch cycle timelines are appropriate rather than emergency response.

An attacker hosts a crafted HTML page containing malicious content targeting Chrome's Cast input validation flaw, then socially engineers a victim into visiting it - via phishing link, malicious advertisement, or compromised website. When the unpatched Chrome browser (prior to 151.0.7922.72) processes the page, the Cast component fails to properly validate the input, enabling a limited bypass of the Same-Origin Policy that allows the attacker to perform constrained cross-origin integrity actions otherwise blocked by the browser. No public exploit code has been identified, and the required user interaction (visiting the page) raises the practical bar for mass exploitation.