CVE-2026-17903: Google Chrome Chromecast XSS Vulnerability

CVE-2026-17903 Overview

CVE-2026-17903 affects Google Chrome versions prior to 151.0.7922.72. The vulnerability results from insufficient policy enforcement in the Chromecast component. An attacker positioned on the same local network segment as a target can inject scripts or HTML into a privileged page via malicious network traffic. Google's Chromium security team rates this issue as Low severity.

The flaw requires local network adjacency rather than remote internet access. Attackers on shared networks such as public Wi-Fi, corporate LANs, or guest networks can send crafted traffic that Chrome's Chromecast integration processes without adequate policy validation.

Critical Impact
Local network attackers can inject arbitrary scripts or HTML into a privileged Chrome page through the Chromecast component, potentially enabling content spoofing or escalation within the browser context.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromecast component within Chrome (Chromium-based cast integration)
Chromium-based browsers that inherit the vulnerable Chromecast code path

Discovery Timeline

2026-07-30 - CVE-2026-17903 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17903

Vulnerability Analysis

The vulnerability resides in Chrome's Chromecast integration, which discovers and communicates with cast-capable devices on the local network. Chrome exposes privileged pages such as chrome://cast and internal cast-related UIs that operate outside the standard web security sandbox. These privileged pages hold elevated permissions relative to normal web content.

Insufficient policy enforcement means the Chromecast code path does not sufficiently validate or sanitize content sourced from network peers before it reaches a privileged page. An attacker on the local network can craft traffic that mimics Chromecast discovery or session data. When Chrome processes this traffic, attacker-controlled strings can be rendered as script or HTML in a privileged context.

This class of issue aligns with [CWE-79] Cross-Site Scripting when injected content executes as script, and with broader improper access control weaknesses when policy checks on privileged surfaces are missing.

Root Cause

The root cause is inadequate content policy enforcement between untrusted local-network input and privileged Chrome UI. Data received from Chromecast peers is trusted more than the threat model warrants. The privileged page consumes this data without applying strict output encoding or a restrictive Content Security Policy that would block injected markup.

Attack Vector

Exploitation requires the attacker to be on the same local network segment as the victim. The attacker sends malicious network traffic that Chrome's Chromecast subsystem accepts as legitimate discovery or session data. The crafted payload is rendered inside a privileged Chrome page, enabling script or HTML injection. Refer to the Chromium Issue Report #497277880 and the Google Chrome Update Announcement for the vendor description.

Detection Methods for CVE-2026-17903

Indicators of Compromise

Unexpected Chromecast or mDNS/SSDP discovery traffic from unfamiliar hosts on the local network segment
Chrome instances running versions earlier than 151.0.7922.72 observed in endpoint inventory
Anomalous connections from browser processes to non-Chromecast devices on ports typically used for cast discovery

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor local network segments for unauthorized devices responding to Chromecast discovery probes
Alert on browser process behavior that deviates from baseline, such as unexpected renderer child processes tied to cast URLs

Monitoring Recommendations

Ingest browser telemetry and endpoint process data into a centralized analytics platform to correlate Chrome version data with network activity
Track guest and BYOD network segments where local-adjacency attacks are more likely
Review DNS-SD and mDNS traffic patterns for spoofed Chromecast service advertisements

How to Mitigate CVE-2026-17903

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force a browser restart after update deployment so the patched binaries load
Audit Chromium-based browsers in the environment and apply corresponding vendor updates

Patch Information

Google addressed the issue in Chrome Stable 151.0.7922.72. Details are available in the Google Chrome Update Announcement and the Chromium Issue Report #497277880. Enterprise administrators should validate that Chrome auto-update is enabled or deploy the patched MSI/PKG through existing software distribution tooling.

Workarounds

Disable the Chromecast media routing feature via enterprise policy where cast functionality is not required
Segment guest and untrusted networks from endpoints that run Chrome to reduce local-adjacency exposure
Restrict use of Chrome on public Wi-Fi networks until the update is applied

bash

# Example: disable Media Router (Chromecast) via Chrome Enterprise policy on Linux
# /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false
}