CVE-2026-14048: Chrome Chromecast Use-After-Free Memory Disclosure

Technical summary

CVE-2026-14048 is a use-after-free vulnerability (CWE-416) in the Chromecast subsystem of Chromium-based browsers. An attacker with network proximity can exploit this by controlling a malicious peripheral device on the local network segment. When the vulnerable browser attempts to interact with the malicious device, it may dereference freed memory, allowing information disclosure from process memory. The attack requires no user interaction and no special privileges, but is limited to the local network boundary. Google assessed this as Low severity in their internal classification, though the CVSS 3.1 score of 6.5 (MEDIUM) reflects the confidentiality impact from arbitrary memory read capability.

Business impact

This vulnerability poses a data confidentiality risk to organizations where untrusted devices may connect to internal networks. Sensitive information such as authentication tokens, session cookies, or cached credentials could be extracted from Chrome's memory if an attacker deploys a malicious peripheral. For enterprise environments with bring-your-own-device policies or shared network segments, this represents a pathway to lateral movement or credential harvesting. The local-network-only requirement limits exposure to internet-facing attack scenarios.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected across all major operating systems: Windows, macOS, and Linux. Any system running a vulnerable Chrome version that permits untrusted devices on the same network segment is at risk. Chromium-based browsers derived from the same codebase may also be affected depending on their version and whether they include the Chromecast component.

Exploitability

Exploitation requires local network access and the ability to introduce a malicious peripheral device. An attacker cannot exploit this remotely over the internet. No user interaction is needed once a malicious device is present on the network. The attack surface is lowest in air-gapped or strictly managed network environments where device connections are controlled. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been documented at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This patch version addresses the use-after-free condition in the Chromecast component. Verify the exact patch version against the official Google Chrome release notes to confirm the fix is included in your targeted version. Organizations should prioritize updates for systems operating on shared or less-trusted network segments.

Patch guidance

Google Chrome auto-updates are enabled by default for most users; however, verify the update has deployed by checking Settings > About Google Chrome to confirm the version is 150.0.7871.47 or higher. For managed enterprise deployments using Chrome policies or configuration management, test the patch in a staging environment before broad rollout. Verify that Chromecast functionality remains operational post-patch to ensure no regression in features your organization depends on.

Detection guidance

Monitor for abnormal Chromecast initialization errors or process crashes involving memory access violations. Look for unusual peripheral device connections on your network segment, particularly unrecognized Bluetooth or USB devices claiming Chromecast or media device capabilities. Within Chrome logs (chrome://crashes or via crash reporting), correlate any memory-related errors with the timeframe and presence of suspicious devices. Network-based detection is limited given the local-only nature; focus on endpoint telemetry and device inventory controls.

Why prioritize this

While the CVSS score is MEDIUM and the vulnerability is not in the KEV catalog, the low barrier to exploitation (no user interaction required) and potential for credential theft warrant prompt patching in environments where network device trust cannot be strictly enforced. The local-network-only boundary significantly reduces enterprise risk compared to remote vulnerabilities, allowing lower priority for air-gapped or highly controlled networks, but higher priority for open or guest network segments.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects High confidentiality impact with no integrity or availability impact (C:H/I:N/A:N). Attack vector is Adjacent Network (AV:A), requiring local network presence but no privilege or user interaction (PR:N/UI:N). The score appropriately captures the information disclosure risk while accounting for the network proximity requirement, placing it in the MEDIUM severity band despite Chromium's internal Low assessment.

Frequently asked questions