Google Chrome contains an input validation flaw in Cast that allows a remote attacker who has already compromised the renderer process to gain higher privileges on the system. The weakness is a classic untrusted input issue (CWE‑20) and also identified as a logic flaw that allows privilege escalation (CWE‑1286). The flaw does not provide network connectivity but enables the attacker to elevate privilege from the renderer to other processes, potentially compromising the host.

All Google Chrome installations running before version 148.0.7778.96 are affected. This includes desktop releases on Windows, macOS, and Linux where Cast functionality is enabled.

The CVSS score is 7.5, indicating a high severity vulnerability. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits yet. However, the attack requires that the attacker has already obtained control of the renderer process, so the vector is local within a compromised browser session. Immediate patching is recommended to eliminate the possibility of privilege escalation from a malicious web page exploiting this Cast input validation issue.