Executive brief
A security vulnerability has been identified in the Chromecast component of Google Chrome. This flaw could allow a remote attacker who has already compromised a browser's rendering process to bypass security boundaries (sandbox escape) using a specially crafted web page. If successfully exploited, this could lead to unauthorized access to the underlying operating system or user data beyond the browser's restricted environment.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the Chromecast component of Google Chrome. The flaw exists due to insufficient validation of untrusted input, which can be leveraged by a remote attacker. A precondition for this attack is a prior compromise of the renderer process. By directing a user to a specially crafted HTML page, the attacker can exploit this lack of validation to achieve a sandbox escape, potentially gaining elevated privileges on the host system. The issue was addressed in Google Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-04-02: disclosed: Reported by Google internal researchers
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47
- 2026-06-30: advisory