Executive brief
Google Chrome is a widely used web browser. A vulnerability in its Cast component could allow an attacker who has already partially compromised the browser to gain higher-level system privileges. This could potentially allow an attacker to bypass security boundaries and gain deeper access to the user's device or data.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Cast component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to escalate their privileges by using a specially crafted HTML page. This vulnerability is triggered when the browser fails to sufficiently validate untrusted input within the Cast functionality. The issue is resolved in Google Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched