An out-of-bounds read vulnerability (CWE-125, CWE-787) exists in the Chromecast component of Google Chrome before version 150.0.7871.47. This vulnerability permits a local attacker to obtain sensitive information from process memory via crafted network traffic. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N, A:N). No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

Successful exploitation allows a local attacker to read sensitive memory contents from the Chrome process, potentially exposing confidential information. There is no impact on integrity or availability. The attack requires user interaction and access to an adjacent network.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to Chrome version 150.0.7871.47 or later once available. Until then, limit exposure to untrusted network traffic and avoid user interaction with suspicious content related to Chromecast functionality.