CVE-2026-17773 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical flaw in chrome's cross-origin resource sharing implementation that stems from inadequate input validation mechanisms within the cast functionality. The issue affects google chrome versions prior to 151.0.7922.72 and allows remote attackers to exploit insufficient validation of untrusted input through carefully crafted html pages. The vulnerability specifically targets the cast component which handles chromecast functionality and cross-origin communication between different web domains. The technical flaw manifests when chrome fails to properly validate or sanitize user-supplied data that flows through the cast api, enabling malicious actors to construct html payloads that can bypass security boundaries.
The operational impact of this vulnerability extends beyond typical cross-site scripting scenarios as it enables unauthorized data leakage across origin boundaries. Attackers can leverage this weakness to access sensitive information from different origins that should normally be isolated by browser security policies. This cross-origin data leakage capability represents a significant threat to user privacy and application security, particularly in environments where multiple domains or applications interact through chromecast functionality. The vulnerability operates at the intersection of web security principles and media streaming protocols, creating an attack surface that can be exploited without requiring user interaction beyond visiting a malicious webpage.
From a cybersecurity perspective, this vulnerability aligns with common weakness enumerations such as CWE-20, which describes improper input validation, and CWE-295, which addresses improper certificate validation. The attack vector follows patterns consistent with cross-origin resource sharing violations and can be mapped to ATT&CK technique T1071.004 for application layer protocol manipulation. The medium severity classification reflects the fact that while this vulnerability requires a crafted webpage to exploit, it provides significant data leakage capabilities that can compromise user privacy and sensitive information across different web domains. Organizations using chrome versions prior to 151.0.7922.72 should immediately implement mitigations including browser updates, content security policies, and network monitoring to detect potential exploitation attempts.
The root cause of this vulnerability lies in the insufficient validation mechanisms within chrome's cast implementation that fail to properly enforce origin policies when processing untrusted input from web pages. This allows attackers to craft html content that can manipulate the cast api behavior to access data from different origins. The fix implemented in chrome version 151.0.7922.72 addresses this by strengthening input validation checks and improving origin verification mechanisms within the cast component. Security practitioners should note that this vulnerability demonstrates the importance of robust input sanitization even in specialized browser components, as seemingly isolated functionality can create unexpected attack vectors when proper security boundaries are not maintained. The remediation approach focuses on enforcing stricter validation of cross-origin requests and ensuring proper isolation between different web origins during cast operations.