CVE-2026-14115 - Vulnerability Details

Description

Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

Published: 2026-06-30

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Google Chrome’s Cast feature contains a flaw that insufficiently validates untrusted input before version 150.0.7871.47. A remote attacker who has already compromised the renderer process can serve a craftily constructed HTML page that triggers escalation of privileges on the host operating system. The vulnerability is an input‑validation weakness (CWE‑20) and is rated with a CVSS base score of 7.5, indicating moderate‑to‑high severity.

Affected Systems

All installations of Google Chrome with versions older than 150.0.7871.47 are impacted. The affected component is the Cast feature in the Chrome browser. Users running version 150.0.7871.47 or newer have the fix applied.

Risk and Exploitability

The EPSS score of less than 1 % suggests a low overall likelihood of exploitation. The CVSS base score is 7.5, indicating moderate‑to‑high severity. The vulnerability is not listed in the CISA KEV catalog, further implying limited current exploitation. Exploitation requires that the attacker already control the renderer process and deliver a malicious HTML page; based on the description, it is inferred that the likely attack vector is web‑based.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[0,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to Chrome version 150.0.7871.47 or later to obtain the fix
Enable automatic updates or install the latest stable release manually if automatic updating is disabled
If a prompt update is not feasible, disable the Cast feature via browser policy or chrome://flags to reduce the attack surface

Generated by OpenCVE AI on July 31, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00242.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513745699

History

Fri, 31 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Validation in Chrome Cast Enables Privilege Escalation

Mon, 27 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Validation in Chrome Cast Enables Privilege Escalation

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Validation in Chrome Cast Allows Privilege Escalation

Tue, 21 Jul 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Validation in Chrome Cast Allows Privilege Escalation

Wed, 15 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Insufficient Cast Input Validation in Chrome

Tue, 14 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Insufficient Cast Input Validation in Chrome

Sun, 12 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Cast Input Validation in Google Chrome

Sat, 11 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Cast Input Validation in Google Chrome

Fri, 10 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Unvalidated Cast Input in Chrome

Wed, 08 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Unvalidated Cast Input in Chrome

Tue, 07 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Validation in Chrome Cast Enables Privilege Escalation

Tue, 07 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Validation in Chrome Cast Enables Privilege Escalation

Mon, 06 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title	Unvalidated Input in Chrome Cast Enables Privilege Escalation

Sat, 04 Jul 2026 23:00:00 +0000

Type	Values Removed	Values Added
Title		Unvalidated Input in Chrome Cast Enables Privilege Escalation

Sat, 04 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation in Chrome Cast from Untrusted Input

Fri, 03 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation in Chrome Cast from Untrusted Input

Fri, 03 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Improper Validation in Chrome Cast Component

Fri, 03 Jul 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Improper Validation in Chrome Cast Component

Thu, 02 Jul 2026 19:45:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Validation in Chrome Cast Enables Privilege Escalation via Crafted HTML

Thu, 02 Jul 2026 14:15:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Validation in Chrome Cast Enables Privilege Escalation via Crafted HTML

Thu, 02 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Title	Chrome Cast Input Validation Error Allows Privilege Escalation

Wed, 01 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome Cast Input Validation Error Allows Privilege Escalation

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
Weaknesses		CWE-20
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513745699

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:39:32.510Z

Updated: 2026-07-02T03:56:16.373Z

Reserved: 2026-06-29T23:11:45.197Z

Link: CVE-2026-14115

Vulnrichment

Updated: 2026-07-01T14:22:47.155Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T16:00:06Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object