Integer overflow in Chromecast in Google Chrome prior to 149

CVE-2026-10924 is an integer overflow in Chrome's Chromecast/media-routing code. Based on the vendor wording you provided, affected builds are Chrome versions before 149.0.7827.53 (with Google's early stable desktop post listing 149.0.7827.53/.54 for Windows and Mac), and exploitation requires the attacker to have *already compromised the renderer process* first. In plain English: a malicious site alone is not enough; the attacker needs a separate renderer bug or equivalent foothold inside the sandboxed tab process before this flaw becomes reachable.

Google's HIGH 8.3 baseline makes sense in a pure browser-exploit-chain context because sandbox escapes are strategically valuable. But for enterprise patch triage, that score overstates the standalone urgency: this is *post-initial-compromise inside the browser*, not a one-bug remote takeover. No KEV listing, very low EPSS, no public exploit chain, and probable feature-path friction around Chromecast/media routing all push this down to MEDIUM for fleet scheduling.

Why this verdict

• -1.6 for prior compromise requirement: vendor CVSS treats this like broadly reachable web risk, but the attacker must first win a separate renderer compromise. That implies post-initial-access inside Chrome's sandbox, not a clean one-bug web takeover.
• -0.4 for exposure narrowing: the vulnerable path sits in Chromecast/media-routing functionality, which is less universally exercised than core rendering, JavaScript, or image parsing surfaces in enterprise browsing.
• -0.3 for exploit maturity: no KEV, no public PoC, and tiny EPSS all say the market has not turned this into a commodity chain component.
• +0.2 for blast-radius significance once chained: if an attacker already has renderer code execution, a successful second-stage browser escape can still materially raise impact on a high-value workstation.

Why not higher?

It is not higher because the key prerequisite already assumes a prior exploit success. Requiring renderer compromise plus likely feature-path reachability turns this into a selective, expensive chain component rather than a fleet-wide emergency on its own.

Why not lower?

It is not lower because Chrome is ubiquitous and browser sandbox escapes matter disproportionately on admin, developer, and executive endpoints. Even without public exploitation, a working chain can convert a contained tab-level compromise into something much more operationally damaging.

1. Enforce Chrome auto-update — Make sure managed browsers are actually receiving Google updates and that version drift is visible in your browser-management console. For a MEDIUM verdict there is no mitigation SLA, so use this as risk reduction while driving toward the remediation window; in practice, Chrome should not sit unpatched for long because update friction is low.
2. Restrict or disable media routing where unused — If your enterprise does not need casting, use Chrome enterprise policy to reduce exposure to the Chromecast/media-router path. This is a sensible compensating control for the affected feature set; for a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window while keeping unnecessary features off managed endpoints.
3. Prioritize high-value endpoint tiers — Admin workstations, developer laptops, and browsing-heavy user populations are where a second-stage browser escape has the most payoff. Use asset criticality to clean up laggards first even though the formal noisgate bucket here is MEDIUM.
4. Hunt for browser exploit signals — Monitor for Chrome crash bursts, exploit-guard alerts, suspicious browser child processes, and anomalous cast/media-router use. These controls do not patch the bug, but they are the most realistic way to catch a chained browser exploit attempt.

Run this on the target endpoint or through your software-distribution/remote-exec tooling. Invoke it with python3 check_chrome_cve_2026_10924.py on macOS/Linux or py check_chrome_cve_2026_10924.py on Windows; local user rights are usually enough, but registry/path access on locked-down Windows images may work more reliably with standard endpoint-management privileges.

#!/usr/bin/env python3
# Check local Google Chrome version against CVE-2026-10924 fixed build.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        return out.strip()
    except Exception:
        return None


def get_windows_version():
    commands = [
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return v, "registry"

    paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for p in paths:
        if p and os.path.exists(p):
            out = run_cmd(["powershell", "-NoProfile", "-Command", f"(Get-Item '{p}').VersionInfo.ProductVersion"])
            if out:
                v = parse_version(out)
                if v:
                    return v, p
    return None, None


def get_macos_version():
    app = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
    if os.path.exists(app):
        out = run_cmd([app, "--version"])
        if out:
            v = parse_version(out)
            if v:
                return v, app
    return None, None


def get_linux_version():
    candidates = ["google-chrome", "google-chrome-stable", "/opt/google/chrome/chrome"]
    for c in candidates:
        out = run_cmd([c, "--version"]) if not c.startswith("/") else (run_cmd([c, "--version"]) if os.path.exists(c) else None)
        if out:
            v = parse_version(out)
            if v:
                return v, c
    return None, None


def main():
    system = platform.system().lower()
    if "windows" in system:
        version, source = get_windows_version()
    elif "darwin" in system:
        version, source = get_macos_version()
    else:
        version, source = get_linux_version()

    if not version:
        print("UNKNOWN - Google Chrome version not found")
        sys.exit(2)

    if cmp_ver(version, FIXED) >= 0:
        print(f"PATCHED - Detected Google Chrome {'.'.join(map(str, version))} via {source}")
        sys.exit(0)
    else:
        print(f"VULNERABLE - Detected Google Chrome {'.'.join(map(str, version))} via {source}; fixed is 149.0.7827.53+")
        sys.exit(1)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (`149.0.7827.53/.54`)
2. Google Chrome Releases index
3. Chromium Security
4. Chromium Security Quarterly Updates
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS
7. Chrome Enterprise - View Chrome browser details
8. Google Chrome Help - Fix Chrome update problems