CVE-2026-14063: Google Chrome Chromecast Memory Disclosure Vulnerability

Technical summary

An out-of-bounds read condition exists in the Chromecast implementation within Google Chrome versions prior to 150.0.7871.47. The vulnerability stems from improper bounds checking (CWE-125) when processing network traffic, which can also lead to buffer overflow conditions (CWE-787). An attacker positioned on the same network segment can craft malicious packets that, when processed by Chromecast, cause the browser to read memory beyond intended boundaries. This leaks uninitialized or sensitive heap data to the attacker without requiring code execution or process privilege escalation. The vulnerability is triggered through user interaction with the malicious traffic, such as connection attempts or device discovery operations.

Business impact

Information disclosure from browser memory can reveal session tokens, cached authentication credentials, browsing history, or other sensitive data resident in the process heap. While Chromecast typically handles media and device control functions, Chrome's unified memory space means the leak may expose data from any active browser context. In regulated environments, unauthorized disclosure of user data may trigger notification obligations and compliance violations. The local network requirement limits exposure to insider threats and compromised network peers, reducing enterprise perimeter risk. However, for organizations with guest networks or BYOD programs, this becomes a more practical concern.

Affected systems

The vulnerability affects Google Chrome prior to version 150.0.7871.47 running on macOS, Linux, and Windows. The Chromecast component is built into Chrome by default. Verify the exact supported versions and patch availability for each operating system against Google's official Chrome release notes. Other Chromium-based browsers may also be affected depending on their integration of Chromecast functionality.

Exploitability

Exploitation requires local network presence (AV:A), no special privileges, and user interaction. The attacker must either reside on the target's network or be able to inject traffic into the network path. The user must engage with a Chromecast discovery or connection action for the malicious payload to be processed. The low complexity of crafting the malicious packet, combined with the passive nature of network-based delivery, means exploitation tooling is likely to emerge quickly once public details are available. However, the requirement for user action and network proximity prevents mass exploitation. This is not a worm-capable vulnerability and is not on the CISA KEV list.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Verify the update applies to all user endpoints, including those managed by policies. For organizations with restricted Chrome auto-update policies, expedite this update through your configuration management system. If immediate patching is not feasible, disable Chromecast functionality via Chrome policies (e.g., RemoteCastingAllowed) to reduce exposure. Restrict network access to Chromecast ports if your environment supports granular network segmentation.

Patch guidance

Google has released Chrome 150.0.7871.47 and later versions with the fix. Ensure your deployment pipeline updates all three affected platforms (Windows, macOS, Linux) concurrently to avoid fragmentation. Check Chrome's release notes and security advisories to confirm the specific build addresses CVE-2026-14063 on your platform. For enterprise deployments, use Google's Chrome Enterprise tools or your mobile device management (MDM) system to enforce the minimum version. Test the update in a pre-production environment if your Chrome deployment includes custom extensions or enterprise policies that may interact with Chromecast.

Detection guidance

Monitor for Chrome process memory dumps or anomalous heap access patterns that correlate with Chromecast network activity. Look for suspicious network traffic on Chromecast discovery ports (typically UDP 5353 for mDNS, TCP/UDP 8008-8009) originating from untrusted network segments. Implement network segmentation to isolate guest and untrusted networks from corporate endpoints. Log Chrome crashes or memory exceptions that might indicate exploitation attempts. Endpoint detection and response (EDR) tools can flag unexpected memory reads by Chrome if configured with appropriate process memory access baselines. However, detection of a successful memory leak itself is difficult; focus on network-level indicators preceding potential exploitation.

Why prioritize this

Though rated MEDIUM severity and not yet on the CISA KEV list, this vulnerability merits prompt attention because: (1) it requires only local network access and user interaction, not code execution; (2) memory disclosure is a reliable reconnaissance vector for follow-on attacks; (3) Chrome's widespread deployment means nearly all organizations are exposed; (4) the fix is straightforward and low-risk; (5) exploitation capability will likely mature quickly once public details circulate. Prioritize it above unpatched low-severity issues, but below critical remote-code-execution vulnerabilities affecting your attack surface.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects: access via adjacent network (AV:A, not remote or local), low attack complexity (AC:L), no privilege requirement (PR:N), required user interaction (UI:R), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N/A:N). The score correctly captures that memory disclosure is serious, but the local network and user interaction prerequisites substantially reduce real-world exposure. Organizations in high-trust networks may weight this lower; those with guest networks or exposed Chromecast devices should treat it as higher priority.

Frequently asked questions