CVE-2026-13884: Integer Overflow in Google Chrome Chromecast – Code Execution Risk

Technical summary

The vulnerability stems from an integer overflow condition (CWE-122) in Chrome's Chromecast implementation prior to version 150.0.7871.47. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same local network segment. No privileges or user action are needed to trigger the condition. The overflow allows stack or heap corruption that leads to arbitrary code execution in the context of the Chrome process. Chromium's maintainers rated this as medium severity internally, though the CVSS 3.1 score of 8.8 reflects the high impact of code execution.

Business impact

Successful exploitation enables an attacker already present on your internal network to run malicious code on any machine running vulnerable Chrome. This is particularly dangerous in shared office networks, coffee shops, or compromised Wi-Fi environments. While it requires local network proximity, the lack of user interaction means it can happen silently. Affected users could lose data confidentiality and integrity, and attackers could use compromised machines as pivot points into corporate systems.

Affected systems

All installations of Google Chrome versions prior to 150.0.7871.47 are vulnerable. The Chromecast component is built into all standard Chrome releases on Windows, macOS, and Linux. Systems running Chrome as a service or as a component of other applications may also be at risk. Verify your installed version via chrome://version/ or the About Chrome menu.

Exploitability

Exploitation requires local network access (same subnet or VLAN), but no user interaction, valid credentials, or special privileges are needed. An attacker could craft malicious network packets to trigger the integer overflow remotely once positioned on the network. The straightforward nature of the attack surface (no complex social engineering) and the lack of user interaction requirements make this moderately practical for an attacker with network access.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism should deploy the fix automatically, but verify completion in Settings > About Chrome. For enterprise deployments, push updates through your device management platform to ensure coverage. Test in a limited environment first if you have custom Chrome configurations.

Patch guidance

Google Chrome version 150.0.7871.47 and all subsequent stable releases contain the fix. Enable automatic updates in Chrome settings if not already active. For Windows domain environments, apply updates via Group Policy or your MDM solution. macOS users should ensure auto-update is enabled in System Preferences > Security & Privacy. Linux users should update through their distribution's package manager or download the latest stable release from google.com/chrome. Verify the patch is applied by checking chrome://version/ and confirming the build number is at least 7871.47.

Detection guidance

Monitor network traffic originating from untrusted network segments for unusual Chromecast-related communications to your endpoints. Look for process crashes or unexpected restarts of Chrome processes, which may indicate exploitation attempts. Endpoint Detection and Response (EDR) solutions should flag attempts to execute code from Chrome's address space via heap spray or stack corruption techniques. Log file analysis may reveal Chrome segmentation faults or memory protection violations. Consider network segmentation to isolate guest Wi-Fi and BYOD networks from critical systems.

Why prioritize this

Although CVE-2026-13884 requires local network proximity and is not a widespread internet-facing threat, the CVSS 8.8 score, ease of exploitation (no user action), and availability of code execution warrant prompt patching. Organizations with open Wi-Fi networks, hot-desking environments, or frequent BYOD access should prioritize this patch within 1–2 weeks. Lower urgency if network segmentation already isolates guest networks from critical infrastructure.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity due to three factors: (1) complete compromise of confidentiality, integrity, and availability within the scope of the affected process; (2) low attack complexity with no user interaction required; (3) adjacent network attack surface, which is more restricted than network-wide but still practical in shared environments. The score appropriately reflects the real-world danger of silent code execution on local networks.

Frequently asked questions