Executive brief
A security issue was identified in the Chromecast component of the Google Chrome web browser. By tricking a user into visiting a specially crafted website, a remote attacker could gain unauthorized privileges within the browser. This could potentially allow the attacker to bypass certain security restrictions or access data they should not have permission to see.
Technical details
This vulnerability is classified as insufficient policy enforcement within the Chromecast component of Google Chrome. The flaw allows a remote attacker to achieve privilege escalation by enticing a user to load a maliciously crafted HTML page. The root cause is a failure to strictly enforce security policies during interactions with Chromecast features. An exploit could allow an attacker to bypass intended security boundaries within the browser environment. The issue is resolved in Google Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory
- 2026-06-30: patched