Vulnary
← back to the feed
Critical· 9.3official fix available

CVE-2026-16416

An integer overflow in Chromecast within Google Chrome can let a local attacker escape the browser sandbox by sending malicious network traffic. The flaw exists in versions before 150.0.7871.182.

publishedJul 21, 2026
last modifiedJul 30, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
1th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 29, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Google Chrome browsers older than version 150.0.7871.182 on any operating system.

02

Real-world impact

A local attacker could break out of the browser sandbox, gaining the ability to read or modify files, install malware, or take control of the system.

03

Why this severity

The CVSS score of 9.3 reflects that the vulnerability is local, requires no privileges, and can lead to complete compromise of confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade Google Chrome to version 150.0.7871.182 or later.
  2. 02Restart the browser to ensure the new version is running.

NVD-referenced vendor advisory

05

Timeline

  1. Jul 21, 2026 · 11d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 30, 2026 · 2d ago
    Advisory updated
    The NVD record was last revised.
  3. Jul 30, 2026 · 2d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2026-16416: An integer overflow in Chromecast within Google Chrome can let a local · Vulnary