CVE-2026-17982: Google Chrome Cast Auth Bypass Vulnerability

CVE-2026-17982 Overview

CVE-2026-17982 is an input validation vulnerability in the Cast component of Google Chrome prior to version 151.0.7922.72. Insufficient validation of untrusted input allows a remote attacker to bypass the same-origin policy through a crafted HTML page. Google classifies the Chromium security severity as Low. The flaw is tracked under [CWE-20: Improper Input Validation].

A successful attack requires the victim to visit an attacker-controlled page. Once triggered, the bypass undermines browser isolation guarantees that normally prevent cross-origin data access between web contexts.

Critical Impact
A remote attacker can bypass the same-origin policy in Chrome via a crafted HTML page, weakening a core browser security boundary.

Affected Products

Google Chrome Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Cast component
Downstream distributions bundling pre-151 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17982 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17982

Vulnerability Analysis

The vulnerability resides in the Cast subsystem of Google Chrome, which handles media routing to remote receivers such as Chromecast devices. Cast processes messages and metadata originating from web contexts and remote endpoints. Insufficient validation of that untrusted input allows an attacker to construct data that Cast handles in a way that violates the same-origin policy.

The same-origin policy is a foundational browser security boundary. It restricts scripts on one origin from reading data belonging to another origin. A bypass in this boundary enables cross-origin data disclosure or interaction that the browser is designed to prevent.

Google rates the Chromium security severity as Low, indicating limited practical impact or constrained exploitation conditions. Details of the underlying defect are restricted in the Chromium Issue Tracker Entry until a majority of users have updated.

Root Cause

The root cause is improper input validation [CWE-20] in the Cast component. Cast accepts input that it does not adequately sanitize or constrain before acting on origin-relevant decisions. This allows crafted content to influence origin handling in a way the browser did not intend.

Attack Vector

Exploitation requires an attacker to host a crafted HTML page and induce a user to visit it. When the page is rendered, it exercises the Cast code path with malformed or unexpected input. The vulnerability is described in the Google Chrome Stable Update announcement.

No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17982

Indicators of Compromise

No public indicators of compromise have been published for this vulnerability.
Suspicious inbound HTML pages that invoke Cast APIs from unexpected origins warrant review.
Chrome instances still reporting versions earlier than 151.0.7922.72 in inventory data.

Detection Strategies

Inventory Chrome and Chromium-based browser versions across managed endpoints and flag builds below 151.0.7922.72.
Monitor browser telemetry and proxy logs for anomalous cross-origin behavior initiated from newly visited domains.
Correlate browser process events with outbound connections to unfamiliar Cast receiver endpoints on the local network.

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and enforce minimum version policies.
Log DNS and HTTP requests from browser processes to identify visits to newly registered or low-reputation domains.
Review web proxy alerts for pages that reference Cast APIs alongside cross-origin data access attempts.

How to Mitigate CVE-2026-17982

Immediate Actions Required

Update Google Chrome to 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Trigger managed browser update policies rather than relying on user-initiated updates.
Update Chromium-based browsers such as Edge, Brave, and Opera once their vendors ship the corresponding fix.

Patch Information

Google released the fix in Chrome Stable channel version 151.0.7922.72. See the Google Chrome Stable Update for release details. The associated Chromium bug is restricted pending broad user adoption of the patched build, as noted in the Chromium Issue Tracker Entry.

Workarounds

Restrict access to untrusted websites through web filtering or DNS-based reputation controls until patching completes.
Disable the Cast feature via enterprise policy where remote media routing is not required.
Enforce browser update compliance as a condition of network access using device posture checks.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enterprise policy example: disable Cast via Chrome policy JSON
# /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false
}