CVE-2026-13884: Google Chrome RCE Vulnerability

CVE-2026-13884 Overview

CVE-2026-13884 is an integer overflow vulnerability in the Chromecast component of Google Chrome prior to version 150.0.7871.47. A local attacker on an adjacent network can execute arbitrary code by sending malicious network traffic to a vulnerable Chrome instance. The flaw is tracked under CWE-122 (Heap-based Buffer Overflow), reflecting how the integer overflow leads to out-of-bounds memory writes on the heap. Google has assigned a Chromium security severity of Medium, while the National Vulnerability Database (NVD) rates the CVSS 3.1 base score at 8.8 (HIGH).

Critical Impact
Arbitrary code execution in the Chrome renderer or Chromecast handling process from an adjacent network attacker, without user interaction.

Affected Products

Google Chrome versions prior to 150.0.7871.47 (Desktop, Stable channel)
Chromium-based browsers that embed the vulnerable Chromecast component
Systems on shared local networks where Chromecast/Cast discovery is enabled

Discovery Timeline

2026-06-30 - CVE-2026-13884 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13884

Vulnerability Analysis

The vulnerability resides in the Chromecast implementation within Google Chrome, which handles Cast device discovery and media streaming over the local network. An integer overflow occurs when the component processes attacker-controlled fields in Cast protocol network traffic. When the overflowed value is used to size or index a heap allocation, subsequent memory operations write outside the intended buffer boundaries. This heap corruption is the classic pattern behind [CWE-122] and can be steered into control of program execution flow.

Because Chromecast handling runs without requiring the user to click or interact with any page, exploitation does not depend on social engineering. The attack surface is exposed as long as the browser is running on a network segment shared with the attacker.

Root Cause

The root cause is missing or insufficient validation of length or size fields parsed from incoming Cast protocol traffic. Arithmetic on these fields wraps past the maximum integer value, producing a small allocation size that is later treated as a much larger buffer during writes. The Chromium fix landed in Chrome 150.0.7871.47 and is documented in the Chromium Issue Tracker Entry.

Attack Vector

The CVSS vector indicates an Adjacent Network attack, meaning the attacker must reside on the same broadcast domain, Wi-Fi network, or logical link as the victim. No privileges and no user interaction are required. An attacker running a rogue Cast device or spoofing responses to Chrome's device discovery can deliver crafted packets that trigger the overflow inside the browser process handling Chromecast. Successful exploitation yields arbitrary code execution in the context of the Chrome process.

See the Chromium Issue Tracker Entry and Google Chrome Stable Update advisory for technical details:
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/500077014

Detection Methods for CVE-2026-13884

Indicators of Compromise

Unexpected Chrome child processes spawning shells, cmd.exe, powershell.exe, or /bin/sh shortly after Cast/mDNS traffic on the local network
Chrome renderer or utility process crashes with heap corruption signatures in Windows Error Reporting or macOS ReportCrash logs
Unusual outbound connections originating from the Chrome process to non-corporate hosts following Cast discovery activity

Detection Strategies

Monitor endpoint telemetry for anomalous child processes descending from chrome.exe or Google Chrome Helper immediately after mDNS/SSDP traffic on UDP ports 5353 and 1900
Alert on Chrome versions below 150.0.7871.47 reported by asset inventory or browser management tooling
Inspect local network traffic for malformed Cast/DIAL protocol messages with abnormally large or negative length fields

Monitoring Recommendations

Baseline Cast device discovery activity per subnet and alert on new or spoofed device advertisements
Correlate browser crash events with preceding local network traffic to identify targeted exploitation attempts
Track EPSS score changes for CVE-2026-13884, currently 0.204% at percentile 10.493, to reassess urgency as exploitation likelihood evolves

How to Mitigate CVE-2026-13884

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after patching to ensure the vulnerable process is replaced
Audit managed Chromium-based browsers and embedded WebView components for the same Chromecast code path

Patch Information

Google released the fix in the Chrome Stable channel as documented in the Google Chrome Stable Update advisory. The corresponding upstream fix is tracked in the Chromium Issue Tracker Entry. Enterprise deployments should push the update through Chrome Browser Cloud Management, Group Policy, or the platform's software distribution mechanism.

Workarounds

Disable Chromecast/Media Router functionality via the EnableMediaRouter enterprise policy set to false until patching completes
Segment untrusted networks to prevent adjacent attackers from reaching endpoints running vulnerable Chrome versions
Restrict use of guest and public Wi-Fi for devices that cannot be immediately updated

bash

# Example: disable Media Router (Chromecast) via Chrome enterprise policy on Linux
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false
}
EOF