CVE-2026-13940

Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Medium)

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html	Release Notes Vendor Advisory
https://issues.chromium.org/issues/513158425	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Uso no inicializado en Cast en Google Chrome anterior a 150.0.7871.47 permitió a un atacante en el segmento de red local obtener información potencialmente sensible de la memoria del proceso a través de tráfico de red malicioso. (Gravedad de seguridad de Chromium: Media)

Information

Published : 2026-06-30 23:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-13940

Mitre link : CVE-2026-13940

CVE.ORG link : CVE-2026-13940

JSON object : View

Products Affected

google

chrome

CWE

CWE-457

Use of Uninitialized Variable

{"id": "CVE-2026-13940", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13940", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T01:26:14.392232Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "chrome-cve-admin@google.com", "affectedData": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "150.0.7871.47", "lessThan": "150.0.7871.47", "versionType": "custom"}]}]}], "published": "2026-06-30T23:17:07.760", "references": [{"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "chrome-cve-admin@google.com"}, {"url": "https://issues.chromium.org/issues/513158425", "tags": ["Permissions Required"], "source": "chrome-cve-admin@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "chrome-cve-admin@google.com", "description": [{"lang": "en", "value": "CWE-457"}]}], "descriptions": [{"lang": "en", "value": "Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Medium)"}, {"lang": "es", "value": "Uso no inicializado en Cast en Google Chrome anterior a 150.0.7871.47 permiti\u00f3 a un atacante en el segmento de red local obtener informaci\u00f3n potencialmente sensible de la memoria del proceso a trav\u00e9s de tr\u00e1fico de red malicioso. (Gravedad de seguridad de Chromium: Media)"}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60AE971A-0580-48EE-A9B8-230C2461E7C1", "versionEndExcluding": "150.0.7871.47"}], "operator": "OR"}]}], "sourceIdentifier": "chrome-cve-admin@google.com"}