PatchGap
Chrome · Cast

CVE-2026-17982

Logic Error in Cast
Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in Cast
DescriptionInsufficient validation of untrusted input in Cast
ComponentCast
Bug ClassLogic Error
Tracker519735808
Fix commitd3ec8b1949b8 (chromium/src) +9/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Files Changed

  • components/media_router/common/media_source.cc
  • components/media_router/common/media_source_unittest.cc

Patch

view commit
From d3ec8b1949b845d93467ae321d5ec2bbb1c85edb Mon Sep 17 00:00:00 2001
From: Muyao Xu <muyaoxu@google.com>
Date: Wed, 10 Jun 2026 16:40:02 -0700
Subject: [PATCH] [MediaRouter] Reject dot-segments as DIAL app names

This CL updates IsDialAppName to explicitly reject '.' and '..' as valid
app names to prevent directory-confinement escape when resolving against
a base URL.

Bug: 519735808
Change-Id: I3e99c4b4be115a3bd6a0bcafa64db505cfb9c826
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7913529
Reviewed-by: Jordan Bayles <jophba@chromium.org>
Commit-Queue: Muyao Xu <muyaoxu@google.com>
Cr-Commit-Position: refs/heads/main@{#1644974}
---

diff --git a/components/media_router/common/media_source.cc b/components/media_router/common/media_source.cc
index 96bc889..23c5134c 100644
--- a/components/media_router/common/media_source.cc
+++ b/components/media_router/common/media_source.cc
@@ -78,7 +78,7 @@
 }  // namespace
 
 bool IsDialAppName(std::string_view app_name) {
-  if (app_name.empty()) {
+  if (app_name.empty() || app_name == "." || app_name == "..") {
     return false;
   }
   // Reject the RFC 3986 dot-segment tokens so GetDialAppUrl()'s Resolve() call
diff --git a/components/media_router/common/media_source_unittest.cc b/components/media_router/common/media_source_unittest.cc
index cf290cb6..750743d 100644
--- a/components/media_router/common/media_source_unittest.cc
+++ b/components/media_router/common/media_source_unittest.cc
@@ -256,6 +256,8 @@
   EXPECT_TRUE(IsDialAppName("com.google.YouTube"));
   EXPECT_TRUE(IsDialAppName("App_Name-1.2~"));
   EXPECT_FALSE(IsDialAppName(""));
+  EXPECT_FALSE(IsDialAppName("."));
+  EXPECT_FALSE(IsDialAppName(".."));
   EXPECT_FALSE(IsDialAppName("App Name"));
   EXPECT_FALSE(IsDialAppName("App/Name"));
   EXPECT_FALSE(IsDialAppName("."));
@@ -268,6 +270,12 @@
       "cast-dial:YouTube?dialPostData=postData&clientId=1234");
   EXPECT_EQ("YouTube", media_source.AppNameFromDialSource());
 
+  media_source = MediaSource("cast-dial:..");
+  EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
+
+  media_source = MediaSource("cast-dial:.");
+  EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
+
   media_source = MediaSource("cast-dial:../YouTube");
   EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/components/media_router/common/media_source_unittest.cc b/components/media_router/common/media_source_unittest.cc
index cf290cb6..750743d 100644
--- a/components/media_router/common/media_source_unittest.cc
+++ b/components/media_router/common/media_source_unittest.cc
@@ -256,6 +256,8 @@
   EXPECT_TRUE(IsDialAppName("com.google.YouTube"));
   EXPECT_TRUE(IsDialAppName("App_Name-1.2~"));
   EXPECT_FALSE(IsDialAppName(""));
+  EXPECT_FALSE(IsDialAppName("."));
+  EXPECT_FALSE(IsDialAppName(".."));
   EXPECT_FALSE(IsDialAppName("App Name"));
   EXPECT_FALSE(IsDialAppName("App/Name"));
   EXPECT_FALSE(IsDialAppName("."));
@@ -268,6 +270,12 @@
       "cast-dial:YouTube?dialPostData=postData&clientId=1234");
   EXPECT_EQ("YouTube", media_source.AppNameFromDialSource());
 
+  media_source = MediaSource("cast-dial:..");
+  EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
+
+  media_source = MediaSource("cast-dial:.");
+  EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
+
   media_source = MediaSource("cast-dial:../YouTube");
   EXPECT_TRUE(media_source.AppNameFromDialSource().empty());
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page