CVE-2026-13900: Chrome Chromecast Navigation Bypass Vulnerability

Technical summary

CVE-2026-13900 stems from improper input validation (CWE-20) in the Chromecast subsystem of Chromium before version 150.0.7871.47. The vulnerability permits a threat actor with control of the renderer process to circumvent navigation restrictions through a malicious HTML page. The renderer compromise prerequisite significantly constrains the practical threat model, as it assumes the attacker has already achieved code execution within the rendering context.

Business impact

The integrity impact is localized to navigation behavior within the affected browser instance. An organization's risk depends on whether Chromecast features are actively used in their environment and whether renderer compromise scenarios are part of their threat model. For most enterprise users, this represents a lower-tier risk given the prerequisite compromise requirement. Content delivery assurance and user trust in browser navigation controls are the primary concerns.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the Chromecast implementation within Chromium. Users running Chrome 150.0.7871.47 or later are not vulnerable. Other Chromium-based browsers may be affected depending on whether they include the vulnerable Chromecast code and version status.

Exploitability

Exploitation requires two conditions: (1) an attacker must first compromise the renderer process, and (2) the user must then visit a malicious HTML page. This two-stage requirement places the vulnerability in the 'high barrier to exploitation' category. The CVSS score of 6.5 reflects the high integrity impact but acknowledges that practical attack scenarios are limited by the renderer compromise prerequisite. No public exploits are currently tracked in CISA's KEV catalog.

Remediation

Users should upgrade to Google Chrome version 150.0.7871.47 or later at the earliest opportunity. Verify the exact patch version through Google's official release notes or the Chrome Settings menu (Help > About Google Chrome). Organizations managing Chrome deployments should prioritize rollout for any users whose threat models include renderer compromise scenarios or who actively use Chromecast functionality.

Patch guidance

Navigate to Chrome Settings, select 'About Google Chrome', and allow the browser to check for and install updates. Chrome will automatically apply version 150.0.7871.47 or later when available and will prompt restart. For enterprise environments, push the update through your mobile device management (MDM) or configuration management tools to enforce consistent patching across the fleet. Verify deployment against the official Google Chrome release notes to confirm the patch addresses this CVE.

Detection guidance

Monitor Chrome version compliance across endpoints to ensure all instances are running 150.0.7871.47 or later. Behavioral detection is challenging because this vulnerability operates within an already-compromised renderer context; focus on upstream prevention of renderer compromise through exploit mitigation features (CFI, ASLR, sandboxing). If you suspect active renderer compromise on an endpoint, treat it as a high-priority incident regardless of Chrome version, as other memory-safety issues may be in play.

Why prioritize this

Although the CVSS base score is 6.5 (MEDIUM), prioritize this patch in a standard maintenance cycle rather than as an emergency. The attack requires pre-existing renderer compromise, which is a significant constraint. However, given Chrome's ubiquity and the established baseline of renderer attacks, patching should not be deferred indefinitely. Organizations with high-value users or high-exposure systems should move this into their next scheduled patch window.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a high integrity impact (I:H) with no confidentiality or availability impact, combined with network accessibility and low attack complexity. The score appropriately captures the ability to bypass navigation restrictions, which undermines user trust and control flow. However, the required renderer process compromise is not fully captured in the base score; in practice, the exploitability is lower than the CVSS base vector alone suggests.

Frequently asked questions