CVE-2026-17798: Google Chrome Cast Data Leak Vulnerability

CVE-2026-17798 Overview

CVE-2026-17798 is an inappropriate implementation vulnerability in the Cast component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Chromium classifies the security severity as Medium.

The flaw undermines the same-origin policy by allowing information from one origin to be observed by another through the Cast feature. Exploitation requires only that the target load attacker-controlled web content in a vulnerable Chrome build.

Critical Impact
Remote attackers can exfiltrate cross-origin data from a victim's browser session via a crafted HTML page, breaking web origin isolation guarantees.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Cast implementation
Any downstream distributions bundling pre-151 Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17798 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17798

Vulnerability Analysis

The vulnerability resides in Chrome's Cast subsystem, which handles media streaming to remote displays such as Chromecast devices. An inappropriate implementation permits a crafted HTML page to observe or infer data belonging to a different origin. This violates the browser's cross-origin isolation model.

Cross-origin data leaks in browser features typically arise when a component fails to enforce origin checks on responses, side-channel timings, or resource states. In this case, the Cast pipeline exposes data that should remain inaccessible to unrelated web origins. The result is an information disclosure primitive usable against any user who visits the attacker's page while running a vulnerable Chrome build.

Root Cause

Google's advisory describes the root cause as an inappropriate implementation in Cast, without publishing internal technical detail. The Chromium issue tracker entry 514460133 remains access-restricted pending broader patch adoption. The defect allows web content to reach across origin boundaries during Cast-related processing.

Attack Vector

The attack requires network-based delivery of a malicious HTML page. A victim running vulnerable Chrome loads the page, and JavaScript on the page triggers the Cast code path to elicit or observe cross-origin data. No authentication is required, and exploitation is remote. User interaction is limited to visiting the page.

The vulnerability is described in the Google advisory. See the Google Chrome Stable Update and Chromium Issue Tracker Entry for vendor references.

Detection Methods for CVE-2026-17798

Indicators of Compromise

Chrome browser processes at versions below 151.0.7922.72 communicating with untrusted domains
Web pages issuing unexpected Cast API calls (chrome.cast, Presentation API) from low-reputation origins
Outbound connections from browser processes to Cast discovery endpoints immediately after visiting unfamiliar sites

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build older than 151.0.7922.72
Inspect browser telemetry and proxy logs for HTML pages that invoke Presentation or Remote Playback APIs from non-business domains
Correlate DNS and HTTP traffic to identify users landing on unknown pages that trigger Cast-related activity

Monitoring Recommendations

Enable enterprise browser reporting to surface version drift and extension activity across managed fleets
Ingest browser and proxy logs into a centralized analytics platform to hunt for Cast API abuse patterns
Monitor for repeated cross-origin resource requests originating from a single tab, which may indicate data leakage attempts

How to Mitigate CVE-2026-17798

Immediate Actions Required

Update Google Chrome to 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after deployment so the patched binary is loaded into memory
Verify update status through enterprise management consoles rather than relying on user-driven updates

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release 151.0.7922.72. Administrators should consult the Google Chrome Stable Update announcement for the full list of fixes shipped alongside CVE-2026-17798. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors incorporate the upstream fix.

Workarounds

Disable the Cast feature via enterprise policy EnableMediaRouter=false where Cast functionality is not required
Restrict outbound access to Cast discovery ports on corporate networks until patching completes
Advise users to avoid unfamiliar links and to close Chrome tabs after use on shared or high-risk sites

bash

# Configuration example: disable Media Router / Cast via Chrome enterprise policy
# Linux managed policy file: /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false
}

# Windows equivalent (registry):
# HKLM\Software\Policies\Google\Chrome\EnableMediaRouter = 0 (DWORD)