CVE-2026-8005: Google Chrome Cast Auth Bypass Vulnerability

CVE-2026-8005 Overview

CVE-2026-8005 affects the Cast component in Google Chrome prior to version 148.0.7778.96. The vulnerability stems from insufficient validation of untrusted input. An attacker positioned on the same local network segment can send malicious network traffic to bypass the same-origin policy. This weakness is classified under [CWE-20: Improper Input Validation].

Google Chrome's Cast feature handles device discovery and media streaming over the local network. The flaw allows adjacent network attackers to violate origin boundaries that protect web content from cross-site access. Chromium's internal severity rating for this issue is Low.

Critical Impact

Adjacent network attackers can bypass the same-origin policy in Chrome's Cast component, undermining a core browser security boundary that isolates content between web origins.

Affected Products

• Google Chrome desktop versions prior to 148.0.7778.96
• Chromium-based browsers incorporating the affected Cast component
• Systems where Chrome Cast functionality is enabled on shared local networks

Discovery Timeline

• 2026-05-06 - CVE-2026-8005 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-8005

Vulnerability Analysis

The vulnerability resides in the Cast subsystem of Google Chrome, which manages communication with media receivers such as Chromecast devices on the local network. Cast relies on parsing network traffic from discovered devices and integrating responses into the browser's media routing logic. Insufficient validation of this untrusted input allows crafted traffic to influence behavior in ways that breach origin isolation.

The same-origin policy (SOP) enforces that scripts and resources from one origin cannot read data from another origin without explicit consent. A bypass in this boundary lets a malicious actor read or interact with content scoped to a different origin in the victim's browser. Because exploitation occurs through the Cast pathway, no direct user interaction with attacker-controlled web content is required beyond having Cast active on the network.

Root Cause

The root cause is improper validation of input received over the local network by Cast. Trust assumptions about discovery and control messages permit data flows that should be rejected or origin-scoped. The defect allows adjacent attackers to influence cross-origin behavior through legitimate Cast channels.

Attack Vector

The attack vector is Adjacent Network. The attacker must reside on the same local network segment as the victim, such as the same Wi-Fi or LAN. No privileges and no user interaction are required. The attacker injects malicious network traffic that the Cast component processes, leading to a same-origin policy bypass with limited confidentiality impact.

No public exploit code, proof-of-concept, or in-the-wild exploitation has been documented. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry and the Google Chrome Releases Update for vendor-published technical context.

Detection Methods for CVE-2026-8005

Indicators of Compromise

• Chrome browser versions below 148.0.7778.96 reported by endpoint inventory or browser telemetry.
• Unexpected Cast discovery or control traffic on local segments where no legitimate Cast receivers exist.
• Anomalous mDNS, SSDP, or DIAL responses originating from non-Cast devices.

Detection Strategies

• Inventory installed Chrome versions across managed endpoints and flag any host running a version prior to 148.0.7778.96.
• Monitor local network traffic for malformed Cast discovery messages or unexpected Cast endpoints advertising on production networks.
• Correlate browser process activity with adjacent-network device discovery events to identify abnormal Cast interactions.

Monitoring Recommendations

• Enable browser version reporting through enterprise management policies and alert on outdated Chrome installations.
• Log mDNS and SSDP traffic on segments where Cast is not authorized for use.
• Review network segmentation logs for cross-VLAN Cast discovery attempts that should not occur.

How to Mitigate CVE-2026-8005

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.96 or later on all desktop endpoints.
• Force Chrome restart after deployment so the patched binary loads in active sessions.
• Validate update compliance through endpoint management tooling and remediate stragglers.

Patch Information

Google released the fix in the Stable channel update for desktop covering Chrome 148.0.7778.96. Apply the vendor patch as documented in the Google Chrome Releases Update. Chromium-based browsers should be upgraded once their maintainers integrate the corresponding upstream fix.

Workarounds

• Disable the Chrome Cast feature on endpoints where casting is not a business requirement.
• Segregate untrusted devices from corporate endpoints using VLANs or wireless network isolation to limit adjacent-network exposure.
• Restrict guest Wi-Fi clients from communicating with managed endpoints to reduce the local attack surface.

# Example enterprise policy to disable Cast via Chrome policy on Linux
sudo tee /etc/opt/chrome/policies/managed/disable_cast.json > /dev/null <<'EOF'
{
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false
}
EOF