Executive brief
A vulnerability in the Google Chrome Cast component could allow an attacker on the same local network to gain elevated privileges. By tricking a user into visiting a specially crafted webpage, the attacker could bypass security restrictions. This could potentially lead to unauthorized access to device functions or data within the local network environment.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Cast component of Google Chrome. The flaw stems from insufficient validation of untrusted input when processing web content. An attacker on the same local network segment can exploit this by hosting a malicious HTML page and inducing a user to visit it. Successful exploitation allows for privilege escalation within the context of the browser's Cast functionality. The issue is resolved in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE published in NVD.