Description

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:49.723Z",
  "pubdate": "2026-08-25T21:17:49.723Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Chromecast implementation of Google Chrome prior to version 152.0.7977.65.\nThe vulnerability originates from improper memory management within the browser's renderer process, which can be triggered by a remote attacker.\nSuccessful exploitation allows a remote attacker who has already compromised the renderer process to perform a sandbox escape, leading to arbitrary code execution outside the restricted environment.\nThis flaw presents a significant security risk as it bypasses the primary security isolation boundaries of the browser.\nExploitation requires the attacker to entice a user to visit a crafted HTML page, which triggers the memory corruption flaw during the processing of web content.\nThe impact is severe, potentially granting the attacker full control over the affected Chromecast device or the underlying system context.",
  "technicalDetails": "The vulnerability is a Use-After-Free (UAF) condition located in the Chromecast component of the Chromium browser architecture. A UAF occurs when a program continues to use a pointer after the memory area it points to has been deallocated, leading to undefined behavior, memory corruption, or control flow hijacking.\nIn this specific instance, the flaw resides within the renderer process, which is responsible for parsing and rendering HTML content. When the renderer process manages the lifecycle of objects incorrectly, an attacker can manipulate the heap state to ensure that a freed object is replaced by attacker-controlled data.\nThe attack flow begins when a user navigates to a malicious, crafted HTML page designed by an attacker. The page triggers the vulnerable code path that causes the renderer process to retain a reference to a deleted object. Through precise heap grooming, the attacker populates the previously freed memory slot with malicious payloads.\nOnce the renderer process dereferences the dangling pointer, it inadvertently executes code or accesses data dictated by the attacker's payload. Because this occurs within the context of the renderer process, it initially violates the integrity of that specific process. However, the flaw extends further by enabling a sandbox escape.\nThe sandbox escape occurs because the vulnerability allows the attacker to leverage the compromised renderer process to interact with privileged components, effectively bypassing the browser sandbox restrictions. By escaping the sandbox, the attacker can execute arbitrary code with privileges beyond those typically granted to the renderer process, potentially leading to full system compromise.\nAffected systems include any environment utilizing Chromecast functionality within Google Chrome versions prior to 152.0.7977.65. This vulnerability does not require authentication from the victim, but it does require the successful compromise of the renderer process and the execution of malicious scripts via a web page. The post-exploitation impact includes persistent control over the device and the ability to exfiltrate sensitive data or execute further malicious commands."
}