CVE-2026-17844: Google Chrome Cast Data Leak Vulnerability

CVE-2026-17844 Overview

CVE-2026-17844 is an input validation vulnerability [CWE-20] in the Cast component of Google Chrome versions prior to 151.0.7922.72. The flaw stems from insufficient validation of untrusted input processed by Chrome's Cast feature. An attacker positioned on the same local network segment can send malicious network traffic to a vulnerable Chrome instance. Successful exploitation leaks cross-origin data, breaking the same-origin policy that isolates content between web origins. Chromium security engineers rated the issue Medium severity.

Critical Impact
A local-network attacker can leak cross-origin data from Chrome users by sending crafted traffic to the Cast subsystem, bypassing browser origin isolation.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chrome Cast component (media routing and discovery)
Downstream Chromium-based browsers that ship the affected Cast code

Discovery Timeline

2026-07-30 - CVE-2026-17844 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17844

Vulnerability Analysis

The vulnerability resides in Chrome's Cast feature, which handles device discovery and media routing to Chromecast and other receivers on the local network. Cast processes network messages from devices reachable on the same network segment. The affected code does not sufficiently validate untrusted input contained in those messages. As a result, an adversary who can send traffic on the local network can influence Cast internals to disclose data belonging to origins other than the attacker's.

Because the leak crosses origin boundaries, it undermines a core browser security invariant. Web applications rely on the same-origin policy to prevent one site from reading data from another. A cross-origin leak via Cast can expose response bodies, headers, or state associated with sites the victim is browsing.

Root Cause

The root cause is improper input validation [CWE-20] in the Cast subsystem when parsing or acting upon untrusted network-supplied data. See the Chromium Issue Tracker Entry for the underlying report.

Attack Vector

Exploitation requires network adjacency. The attacker must be on the same local network segment as the victim, for example a shared Wi-Fi network, corporate LAN, or hotel network. The attacker sends malicious traffic that Chrome's Cast component processes, causing cross-origin data to be leaked. No victim interaction beyond running Chrome with Cast enabled is described in the advisory. Refer to the Google Chrome Desktop Update advisory for release details.

No verified proof-of-concept code is available. Technical specifics of the crafted network messages are restricted while the fix rolls out.

Detection Methods for CVE-2026-17844

Indicators of Compromise

Unexpected mDNS, SSDP, or DIAL discovery traffic originating from unmanaged hosts on the local network segment.
Chrome browser versions below 151.0.7922.72 observed in endpoint inventory telemetry.
Anomalous connections from browser processes to unknown devices advertising Cast receiver services.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 151.0.7922.72.
Monitor local network segments for rogue devices advertising Cast, Chromecast, or DIAL services outside of expected asset lists.
Correlate browser process network activity with device discovery protocols to spot unusual receiver interactions.

Monitoring Recommendations

Alert on Chrome installations that fall behind the current stable channel release for more than one patch cycle.
Log DNS-SD and SSDP traffic on user network segments and baseline expected Cast receivers.
Review guest and BYOD network segmentation to confirm that untrusted devices cannot reach corporate user endpoints on Cast discovery ports.

How to Mitigate CVE-2026-17844

Immediate Actions Required

Update Google Chrome for Desktop to version 151.0.7922.72 or later on all managed endpoints.
Force a Chrome relaunch after the update so the patched Cast component is loaded into memory.
Audit Chromium-based browsers such as Edge, Brave, and Vivaldi and apply their corresponding vendor updates once released.

Patch Information

Google addressed CVE-2026-17844 in the Chrome Stable channel release announced in the Google Chrome Desktop Update. Upgrade Chrome to 151.0.7922.72 or later. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or the endpoint management platform used to distribute browser builds.

Workarounds

Disable the Chrome Media Router via the MediaRouterCastAllowAllIPs and EnableMediaRouter enterprise policies until patching completes.
Segment user endpoints away from untrusted local networks that could host attacker-controlled devices.
Restrict Cast discovery protocols (mDNS UDP 5353, SSDP UDP 1900) at the network layer for high-risk user populations.

bash

# Configuration example: disable Chrome Media Router via enterprise policy (Linux/macOS JSON policy)
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false
}
EOF