CVE-2026-17903CWE-79cross-site-scripting
CVE-2026-17903
Medium · published July 30, 2026
What it is
Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML into a privileged page via malicious network traffic. (Chromium security severity: Low)
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00165 · 5.5th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-07-30T05:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| google/chrome | < 151.0.7922.72 | 151.0.7922.72 |
References (2)
EPSS history
Timeline