Executive brief
A vulnerability in Google Chrome's Cast functionality could allow an attacker on the same local network to access sensitive data from other websites or services. This occurs because the browser does not properly validate certain network traffic, potentially leading to the exposure of private information. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Cast component of Google Chrome. The flaw stems from insufficient validation of untrusted input received over the network. An attacker positioned on the same local network segment (Adjacent) can exploit this by sending malicious network traffic to a vulnerable client. Successful exploitation allows the attacker to bypass cross-origin restrictions and leak sensitive data. The issue is resolved in Google Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable Channel Update 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date