CVE-2026-17769: Google Chrome Cast Info Disclosure Flaw

CVE-2026-17769 Overview

CVE-2026-17769 is an input validation vulnerability in the Cast component of Google Chrome. Versions prior to 151.0.7922.72 fail to properly validate untrusted input processed by the Cast feature. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Chromium classifies the security severity as Medium. The weakness is tracked under CWE-20: Improper Input Validation.

Critical Impact
Remote attackers can exfiltrate cross-origin data from a victim's browser session by luring them to a malicious webpage, bypassing the same-origin policy that isolates web content.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Cast component
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-07-30 - CVE-2026-17769 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17769

Vulnerability Analysis

The vulnerability resides in Chrome's Cast component, which handles media streaming to compatible receiver devices. Cast fails to sufficiently validate untrusted input supplied through a crafted HTML page. The defect allows an attacker-controlled page to trigger behavior that discloses data belonging to other origins. Cross-origin data leakage undermines the same-origin policy, one of the core browser security boundaries.

Exploitation requires no authentication and no elevated privileges. The victim must interact with attacker-controlled web content, meaning phishing or malicious advertising can deliver the payload. Successful exploitation impacts confidentiality of user data across origins the victim has accessed.

Root Cause

The root cause is improper input validation [CWE-20] in code paths that process attacker-controlled data within the Cast subsystem. Trust boundaries between origins are not enforced during Cast operations, permitting information originally scoped to one origin to become observable from another.

Attack Vector

The attack vector is remote and web-based. An attacker hosts a crafted HTML page containing markup or scripting that exercises the vulnerable Cast code path. When a Chrome user visits the page, the browser processes the malicious input and leaks cross-origin data back to the attacker. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for release-level details.

No public proof-of-concept code is available for CVE-2026-17769.
Refer to the Chromium Issue Tracker for restricted technical details.

Detection Methods for CVE-2026-17769

Indicators of Compromise

Chrome desktop clients reporting version strings below 151.0.7922.72 in browser telemetry or user-agent logs.
Outbound requests from browser processes to unfamiliar domains immediately after users load untrusted HTML content.
Unexpected Cast session initiation events on endpoints that do not normally use Cast receivers.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below the patched build 151.0.7922.72.
Correlate web proxy logs with browsing activity to identify visits to newly registered or low-reputation domains serving HTML that triggers Cast APIs.
Monitor endpoint process telemetry for Chrome renderer processes exhibiting anomalous network egress patterns following page loads.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and alert on hosts running unpatched Chrome builds.
Track Chrome auto-update health metrics to confirm the Stable channel is reaching endpoints without failure.
Baseline normal Cast usage patterns per user population to surface unusual activation events.

How to Mitigate CVE-2026-17769

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed desktops.
Restart Chrome processes after the update so the patched binaries load into memory.
Audit third-party Chromium-based browsers and confirm the vendor has merged the upstream fix.

Patch Information

Google addressed CVE-2026-17769 in Chrome Stable 151.0.7922.72. Details are documented in the Google Chrome Update Announcement. The Chromium project tracks the underlying issue at Chromium Issue Tracker Entry.

Workarounds

Disable Cast functionality through enterprise policy where the feature is not required for business use.
Restrict browsing to trusted domains via URL filtering until patch deployment completes.
Enforce Chrome auto-updates through Group Policy or MDM to minimize exposure windows on future disclosures.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Example Chrome enterprise policy to disable Cast (JSON on Windows/macOS)
# Place in the Chrome managed policies directory
{
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false
}