CVE-2026-17773: Google Chrome Cast Data Leak Vulnerability

CVE-2026-17773 Overview

CVE-2026-17773 affects the Cast component in Google Chrome versions prior to 151.0.7922.72. The vulnerability stems from insufficient validation of untrusted input, which allows a remote attacker to leak cross-origin data through a crafted HTML page. Chromium rates the security severity as Medium. An attacker who convinces a user to visit a malicious page can extract data that same-origin policy is designed to protect. The issue is tracked in the Chromium project and was resolved in the Stable channel update for Desktop.

Critical Impact
Remote attackers can leak cross-origin data from browsers running vulnerable Chrome builds by luring users to a crafted HTML page.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Cast component
Downstream distributions that ship pre-151 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17773 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17773

Vulnerability Analysis

The flaw resides in Chrome's Cast subsystem, which handles media routing to Chromecast and other cast-capable receivers. Cast integrates tightly with the renderer to expose device discovery and session APIs to web content. The subsystem accepts input that should be constrained to trusted origins and validated against origin boundaries. Insufficient validation of that input allows attacker-controlled content to influence Cast operations in ways that expose data belonging to another origin. The result is a cross-origin information disclosure reachable from any web page the victim loads.

Root Cause

The underlying weakness is classified as [CWE-20] Improper Input Validation. Cast trusts fields or parameters supplied by a web page without enforcing the origin checks required to keep responses within the requesting origin. When the crafted input is processed, response data that should be isolated by the same-origin policy becomes observable to the attacker's page.

Attack Vector

Exploitation requires a victim to load a crafted HTML page under attacker control. No authentication or elevated privileges are needed. The malicious page issues Cast-related interactions designed to elicit responses containing data from a different origin. Because delivery is web-based, phishing links, malvertising, and compromised sites are all viable delivery paths.

No verified public proof-of-concept code is available. Technical detail on the specific input path is tracked in the Chromium Issue Tracker Entry and the Google Chrome Desktop Update.

Detection Methods for CVE-2026-17773

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 in enterprise inventories
Outbound requests from browser processes to unfamiliar domains immediately following visits to untrusted pages
Unexpected Cast API activity originating from non-media browsing sessions

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag builds below 151.0.7922.72.
Correlate browser child process telemetry with DNS and proxy logs to surface pages that trigger Cast-related network activity outside expected media workflows.
Monitor endpoint EDR telemetry for browser renderer processes performing anomalous cross-origin data reads or exfiltration patterns.

Monitoring Recommendations

Track Chrome version compliance continuously through configuration management tooling rather than point-in-time scans.
Alert on outbound HTTP POST traffic from browser processes to newly observed domains hosting HTML content.
Review web proxy logs for user visits to low-reputation domains that coincide with Chrome renderer anomalies.

How to Mitigate CVE-2026-17773

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart after deployment so the patched binary replaces the running process.
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their vendor updates once they incorporate the upstream fix.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel with version 151.0.7922.72. Details are published in the Google Chrome Desktop Update release note. Enterprises using managed Chrome policies should confirm the TargetVersionPrefix policy is not pinning clients to an older build.

Workarounds

Restrict access to untrusted sites through web filtering while patch rollout completes.
Disable the Cast feature via enterprise policy where media routing is not required for business use.
Isolate high-risk browsing through remote browser isolation for users who cannot receive the update immediately.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows enterprise policy example to disable Cast
# HKLM\SOFTWARE\Policies\Google\Chrome
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v EnableMediaRouter /t REG_DWORD /d 0 /f