GCVE - cpe:2.3:h:google:chromecast:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:google:chromecast:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Google (`f181d1eb-7269-5bae-b76e-e66ceb214562`)
Product	Chromecast (`77698dc9-bc20-5ac1-9b3b-69da3dd0c6a9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-6181`	not_vulnerable	2026-06-08 06:19:46.504424	Details available An oversight in BCB handling of reboot reason that allows for persistent code execution Published: 2023-12-11T05:17:05.043Z Updated: 2024-08-02T08:21:17.796Z Open on db.gcve.eu Reference links https://source.android.com/docs/security/bulletin/chromecast/2023-12-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48425`	not_vulnerable	2026-06-08 06:14:27.182903	Details available U-Boot vulnerability resulting in persistent Code Execution Published: 2023-12-11T05:15:59.638Z Updated: 2025-05-27T14:44:28.733Z Open on db.gcve.eu Reference links https://source.android.com/docs/security/bulletin/chromecast/2023-12-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48424`	not_vulnerable	2026-06-08 06:14:27.182277	Details available U-Boot shell vulnerability resulting in Privilege escalation in a production device Published: 2023-12-11T05:13:01.011Z Updated: 2026-02-25T17:20:13.162Z Open on db.gcve.eu Reference links https://source.android.com/docs/security/bulletin/chromecast/2023-12-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48417`	not_vulnerable	2026-06-08 06:14:27.169540	Details available Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application Published: 2023-12-11T05:09:48.557Z Updated: 2024-08-02T21:30:34.916Z Open on db.gcve.eu Reference links https://source.android.com/docs/security/bulletin/chromecast/2023-12-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-12716`	not_vulnerable	2026-06-08 05:10:41.910121	Details available The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request. Published: 2018-06-25T02:00:00.000Z Updated: 2024-09-17T01:15:52.874Z Open on db.gcve.eu Reference links https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/ https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/ https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.