CVE-2026-17870: Google Chrome Cast Information Disclosure

CVE-2026-17870 Overview

CVE-2026-17870 is an input validation vulnerability [CWE-20] in the Cast component of Google Chrome versions prior to 151.0.7922.72. The flaw stems from insufficient validation of untrusted input processed by Chrome's Cast functionality. An attacker positioned on the same local network segment as the victim can send crafted network traffic to leak cross-origin data from the browser. Google's Chromium team rates the security severity as Medium. The vulnerability does not require user interaction beyond normal browser use with Cast features active.

Critical Impact
A local network attacker can leak cross-origin data from a victim's Chrome browser by sending malicious traffic to the Cast component, breaking the same-origin policy that isolates web content.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Cast component
Systems on shared local network segments where Cast discovery is active

Discovery Timeline

2026-07-30 - CVE-2026-17870 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17870

Vulnerability Analysis

The vulnerability resides in Chrome's Cast subsystem, which handles media streaming and device discovery for Google Cast targets such as Chromecast devices. Cast uses local network protocols to enumerate and communicate with receivers on the same subnet. The affected code fails to properly validate untrusted input arriving over these network channels. As a result, an attacker on the same local network segment can craft malicious traffic that causes the browser to disclose data protected by the same-origin policy.

Cross-origin data leaks undermine a core browser security guarantee. Web applications rely on origin isolation to keep authenticated sessions, tokens, and user data confined to their originating site. When a network-adjacent attacker can extract this data through the Cast pathway, they gain visibility into information that should be inaccessible to any other origin.

Root Cause

The root cause is improper input validation [CWE-20] within Cast's handling of network-supplied data. The component accepts and processes messages from local network peers without adequately verifying their contents or enforcing origin boundaries on the resulting operations.

Attack Vector

Exploitation requires the attacker to occupy the same local network segment as the target. Typical scenarios include public Wi-Fi, corporate guest networks, and compromised home routers. The attacker sends crafted network traffic that the victim's Chrome Cast component parses. The malformed input triggers behavior that leaks data across origin boundaries back to the attacker. No credentials or authentication on the victim's browser are required. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor context.

Detection Methods for CVE-2026-17870

Indicators of Compromise

Unexpected Cast discovery or session traffic on local subnets from devices not owned by the organization
Chrome instances running versions earlier than 151.0.7922.72 after the patch release window
Anomalous mDNS, SSDP, or DIAL protocol traffic targeting endpoints running Chrome

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build below 151.0.7922.72
Monitor local network traffic for malformed or unusually structured Cast protocol messages
Correlate Cast-related network activity with browser process telemetry to identify unexpected cross-origin data flows

Monitoring Recommendations

Enable browser version telemetry through enterprise management tooling to track patch compliance
Log DNS-SD, mDNS, and Cast SDK traffic on segments that host user endpoints
Alert on rogue Cast receivers advertising services on corporate or sensitive network segments

How to Mitigate CVE-2026-17870

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
Restart Chrome after applying the update to ensure the patched Cast component is loaded
Verify enterprise update policies are enforcing the current Stable channel build

Patch Information

Google released the fix in the Chrome Stable channel version 151.0.7922.72. Details are published in the Google Chrome Update Announcement. The corresponding Chromium tracking record is available in the Chromium Issue Tracker Entry.

Workarounds

Disable Cast functionality via enterprise policy where media streaming is not required
Segment guest and untrusted devices away from network segments hosting corporate endpoints
Restrict outbound mDNS and Cast discovery traffic on sensitive VLANs until patching is complete

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 151.0.7922.72 or later