CVE-2026-13940: Chrome Cast Uninitialized Memory Disclosure – Patch Now

Technical summary

CVE-2026-13940 is an uninitialized use vulnerability (CWE-457) in Google Chrome's Cast implementation that occurs during a type-casting operation. The flaw allows an unauthenticated attacker on an adjacent network segment (AV:A) to cause Chrome to access uninitialized memory regions and leak their contents via malicious network traffic. The attack requires no user interaction and does not depend on complex or costly exploitation preconditions (AC:L). Impact is limited to confidentiality; the vulnerability does not enable code execution or denial of service. The Chromium project assigned this a Medium security severity rating.

Business impact

Information disclosure through memory leaks can expose sensitive user data including authentication tokens, cached credentials, personal information from open tabs, or encryption keys resident in Chrome's memory. While the attack requires network-level proximity, organizations with open wireless networks, compromised internal networks, or shared network segments face increased risk. This vulnerability does not directly enable data modification or service disruption, but the leaked information could facilitate secondary attacks such as session hijacking or credential theft.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. The vulnerability specifically impacts the Cast feature, so systems with Cast functionality enabled (which is the default in most Chrome deployments) are in scope. Desktop, laptop, and Chromebook installations running vulnerable versions on networks where an attacker can position themselves locally are at risk.

Exploitability

Exploitation requires the attacker to be on the same local network segment as the target; remote internet-based attacks are not possible. No special privileges, credentials, or user interaction are needed once network proximity is achieved. However, the attacker must craft malicious network packets specific to the Cast protocol or related network services, indicating some technical skill and preparation. The vulnerability is not known to be exploited in the wild (not listed on the KEV catalog) and no public exploit code has been published as of the vulnerability disclosure date.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. The patch addresses the uninitialized memory access by ensuring proper initialization of variables in the Cast feature's type-casting operations. Users can verify their current Chrome version by navigating to Chrome menu > Help > About Google Chrome, which will automatically check for and install available updates. Organizations should prioritize patching systems in shared network environments or those exposed to untrusted local networks.

Patch guidance

Chrome automatically downloads and applies security updates; most users will be updated to version 150.0.7871.47 or newer within days of release. Administrators managing enterprise Chrome deployments via Chromium policies should verify the update has rolled out using the chrome://policy page or their management console. For users with auto-update disabled, manually check for updates via the About Chrome menu. No interim mitigations are documented; patching is the only remediation.

Detection guidance

Detection is challenging because the vulnerability is triggered by network packets on the local segment; traditional perimeter-based monitoring will not see the attack traffic. Network segmentation and monitoring of unexpected traffic on the Cast protocol (typically UDP on specific ports) from untrusted endpoints may provide signals. Endpoint detection and response (EDR) tools may observe suspicious network access patterns or unusual process memory reads if Cast-related processes behave anomalously, but signatures are not yet widely available. Organizations should focus on ensuring networks are properly segmented and that wireless access is secured to prevent unauthorized local network presence.

Why prioritize this

While rated CVSS 6.5 (medium), this vulnerability merits attention because: (1) Chrome is ubiquitous in enterprise and consumer environments; (2) local network access is increasingly feasible given BYOD policies, compromised guest networks, and supply-chain threats; (3) memory disclosure can directly lead to credential theft and lateral movement; (4) the fix is simple and automated. Patching should proceed on a standard schedule for medium-severity flaws, with higher priority for systems in open or untrusted network environments.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects attack vector (adjacent network only, not internet-facing), low complexity exploitation, no privilege or user interaction requirement, and high confidentiality impact with no integrity or availability impact. The score appropriately captures the local-network-only attack surface that limits exposure compared to remotely exploitable vulnerabilities, while acknowledging the real privacy and security risk of uncontrolled memory disclosure.

Frequently asked questions