CVE-2026-11241: Chrome Cast Privilege Escalation via Malicious HTML (CVSS 8)

Technical summary

CVE-2026-11241 is an input validation flaw in the Cast subsystem of Google Chrome versions prior to 149.0.7827.53. The vulnerability stems from insufficient sanitization of untrusted input (CWE-20), allowing an adjacent network attacker to construct a malicious HTML payload that, when rendered by a user's browser, executes code with elevated privileges. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates attack complexity is low, but requires user interaction and proximity to the victim's network segment. The flaw does not cross privilege or security boundaries at the kernel level.

Business impact

Successful exploitation allows lateral movement and privilege escalation within corporate or residential networks. An attacker could gain administrative-level control over a single endpoint, leading to theft of sensitive data, installation of malware, system sabotage, or lateral pivots to other hosts. The requirement for local network access somewhat limits exposure in air-gapped or strictly segmented environments, but most organizations have guest networks, IoT devices, or contractor access that could harbor an attacker. Remediation delays increase risk of compromise of high-value user accounts or systems.

Affected systems

Google Chrome prior to version 149.0.7827.53 running on Windows, macOS, or Linux. Verify the exact Chrome version in your environment—the patch version 149.0.7827.53 is the first version containing the fix. Other Chromium-based browsers may also require updates; check with individual vendors (Edge, Brave, Vivaldi, etc.) for their patched versions. The vulnerability is not a kernel issue affecting all operating systems broadly, but rather a Chrome-specific defect.

Exploitability

Exploitation requires an attacker to be on the local network segment and to successfully socially engineer a user into visiting a malicious HTML page. The attack does not require user privileges or special browser configuration; standard browsing activity is sufficient. The low attack complexity and user-interaction requirement make this moderately exploitable in practice, especially in environments where users frequently visit untrusted sites or click suspicious links. The necessity for network adjacency significantly reduces the threat surface compared to internet-wide attacks.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Enable automatic updates in Chrome settings (Settings > About > Google Chrome) to receive patches automatically. For organizations using managed Chrome deployments, apply the update through your management console. If using other Chromium-based browsers, check the respective vendor for equivalent patched versions and timelines. Monitor for any suspicious Cast-related activity or unexpected privilege escalations on affected systems.

Patch guidance

Google has patched this vulnerability in Chrome 149.0.7827.53 and later. Verify your current Chrome version by navigating to Settings > About > Google Chrome; the browser will check for updates automatically and display the current version number. If you are running an earlier version, accept the available update without delay. For enterprise environments, leverage your browser management tools to enforce the minimum version requirement. Consider disabling the Cast feature on sensitive systems if patching is delayed, though this is a workaround and not a substitute for patching.

Detection guidance

Monitor network traffic for suspicious Cast protocol activity from unexpected sources on port 8008 or over mDNS. Examine browser history and process logs on endpoints for unusual Cast operations or suspicious HTML page visits from internal network sources. Web content filtering or proxy logs may reveal attempts to serve malicious HTML payloads to users. Endpoint Detection and Response (EDR) tools should alert on privilege escalation events following Chrome process activity. Additionally, audit Cast device discovery logs if available, as the attack initiates through crafted HTML rendered in the browser.

Why prioritize this

Although Chromium rates this as low severity and it requires local network adjacency, the CVSS 8 (HIGH) score reflects the severity of impact once triggered—full compromise of user confidentiality, integrity, and availability. Prioritize patching in environments with guest networks, frequent contractor access, or elevated-risk user populations. However, air-gapped networks or strict segmentation may defer this slightly lower than critical internet-facing vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8 (HIGH) is assigned because the vulnerability grants high-impact confidentiality, integrity, and availability compromise (C:H/I:H/A:H) to an adjacent attacker with low complexity (AC:L) and no privileges required (PR:N). However, the attack vector is Adjacent Network (AV:A) rather than Network, and it requires User Interaction (UI:R), which moderates the theoretical exploitability. The score reflects the severity of impact rather than immediate likelihood of widespread exploitation, making it a HIGH-severity finding that warrants timely remediation in most environments.

Frequently asked questions