CVE-2026-13797: Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in the Chromecast component of Google Chrome prior to version 150.0.7871.47. A remote attacker who has already compromised the Chrome renderer process can exploit insufficient input validation by tricking a user into visiting a crafted HTML page, breaking out of Chrome's security sandbox and gaining capabilities beyond what the browser process should allow. Successful exploitation gives the attacker high-impact access to confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target must be reachable via a browser session exposed to attacker-controlled content.

• AuthenticationNot required

  No credentials or account access are needed; any user who visits the crafted page can be targeted.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions, race requirements, or environmental dependencies beyond the renderer compromise prerequisite.

Blast Radius

• A successful attacker escapes the Chrome sandbox and executes code outside the browser's restricted process, gaining access to the underlying host environment.
• Confidentiality is fully compromised: the attacker can read files, credentials, session tokens, and other data accessible to the host user.
• Integrity is fully compromised: the attacker can write, modify, or delete files and data on the host system.
• Availability is fully compromised: the attacker can crash, kill, or otherwise disrupt the host system or its services.