A heap buffer overflow exists in the Chromecast component of Google Chrome on Android, Linux, and ChromeOS for builds prior to 148.0.7778.179. The vulnerability allows a local user to inject malicious network traffic that can trigger a buffer overflow and lead to arbitrary code execution inside a Chrome sandboxed process. This flaw falls under CWE‑122 (heap-based buffer overflow) and CWE‑120 (improper buffer size calculation). Chromium labels the issue as medium severity. The impact is that the code runs with the privileges to Chrome’s sandbox, which can enable broader system compromise if privilege escalation is possible.

The affected products include Google Chrome deployed on Android devices, Linux distributions, and ChromeOS devices running versions older than 148.0.7778.179. Users on these platforms that have not applied the latest patch are at risk.

The vulnerability requires that an attacker has local access to the device and can generate network traffic directed at Chrome’s Chromecast interface. No publicly documented exploits exist, which is reflected in the EPSS score of less than 1%, indicating a low probability of exploitation. The CVSS score of 7.5 denotes high severity. Because the flaw is limited to the Chrome sandbox, the potential damage is confined to what the sandbox permits, but the local nature of the attack makes immediate action important.