Description
Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Low)
Published: 2026-06-30
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Memory Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability involves an out‑of‑bounds read (CWE‑125) and is also classified under CWE‑787 (out‑of‑bounds write) in the Chromium Chromecast component of Google Chrome. A local attacker can send crafted network traffic that triggers a read of memory beyond the intended bounds, exposing sensitive data from the browser’s process memory. Additionally, the CWE‑787 classification indicates a potential for a buffer overflow that an attacker might exploit to affect adjacent memory regions.

Affected Systems

Users of Google Chrome older than version 150.0.7871.47 are affected. The issue was fixed in release 150.0.7871.47.

Risk and Exploitability

The CVSS score of 5.7 indicates low to moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The flaw is local; it requires the attacker to influence traffic to the affected machine. Given that it is not listed in the CISA KEV catalog, no widespread exploitation is reported.

Generated by OpenCVE AI on August 2, 2026 at 00:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.47 or later
  • Enable Chrome’s automatic update feature to receive future security fixes promptly
  • Block Chromecast UDP ports or disable the Chromecast feature in Chrome settings until the patch is applied

Generated by OpenCVE AI on August 2, 2026 at 00:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Sun, 02 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Chromecast Out-of-Bounds Read Enables Local Process Memory Disclosure

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Local Memory Disclosure via Chromecast Out-of-Bounds Read

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Local Memory Disclosure via Chromecast Out-of-Bounds Read

Tue, 21 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Local Attacker Can Read Process Memory via Malicious Network Traffic in Chromecast

Wed, 15 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Local Attacker Can Read Process Memory via Malicious Network Traffic in Chromecast

Mon, 13 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read and Write in Chrome Chromecast Leading to Local Memory Disclosure

Sun, 12 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read and Write in Chrome Chromecast Leading to Local Memory Disclosure

Sat, 11 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Chromecast Out-of-Bounds Read Enables Local Process Memory Exposure

Fri, 10 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Chromecast Out-of-Bounds Read Enables Local Process Memory Exposure

Fri, 10 Jul 2026 04:15:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Enables Local Memory Disclosure in Google Chrome

Thu, 09 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Enables Local Memory Disclosure in Google Chrome

Wed, 08 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Permits Local Memory Disclosure in Chrome

Tue, 07 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Permits Local Memory Disclosure in Chrome

Mon, 06 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Local Memory Disclosure via Out‑of‑Bounds Read in Chrome Chromecast

Mon, 06 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Title Local Memory Disclosure via Out‑of‑Bounds Read in Chrome Chromecast

Sun, 05 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in Chromecast Allows Local Memory Disclosure in Google Chrome

Sun, 05 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in Chromecast Allows Local Memory Disclosure in Google Chrome

Sat, 04 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in Google Chrome Chromecast Component Allows Local Memory Disclosure

Fri, 03 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in Google Chrome Chromecast Component Allows Local Memory Disclosure

Fri, 03 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Local Out-of-Bounds Read in Chromecast Enables Memory Disclosure

Thu, 02 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Local Out-of-Bounds Read in Chromecast Enables Memory Disclosure

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Allows Local Memory Disclosure in Chrome

Thu, 02 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Chromecast Out‑of‑Bounds Read Allows Local Memory Disclosure in Chrome

Wed, 01 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in Chrome Chromecast Enables Local Memory Disclosure

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Wed, 01 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in Chrome Chromecast Enables Local Memory Disclosure

Wed, 01 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Chromium Out-of-Bounds Read in Chromecast Allows Local Memory Disclosure
Weaknesses CWE-20
CWE-788

Wed, 01 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Title Chromium Out-of-Bounds Read in Chromecast Allows Local Memory Disclosure
Weaknesses CWE-20
CWE-788

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Low)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T13:48:31.951Z

Reserved: 2026-06-29T23:11:34.671Z

Link: CVE-2026-14063

cve-icon Vulnrichment

Updated: 2026-07-01T01:19:04.763Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-30T23:17:18.580

Modified: 2026-10-25T21:10:00.770

Link: CVE-2026-14063

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T00:15:06Z

Weaknesses