CVE-2026-14048 | Use after free in Chromecast in Google Chrome prior to 150.0… | CVSS 6.5 MEDIUM

Description

Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)

Metadata

CVE ID: CVE-2026-14048
State: PUBLISHED
Assigner: Chrome
Reserved: 2026-06-29 23:11 UTC
Published: 2026-06-30 22:39 UTC
Last updated: 2026-07-01 01:18 UTC
Primary CWE: CWE-416
Use after free
Vendor / Product: Google / Chrome
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Google	Chrome	—	150.0.7871.47 < 150.0.7871.47

Weakness (CWE)

CWE	Source	Description
CWE-416	cna	Use after free

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	adp	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)