Description

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:01.263Z",
  "pubdate": "2026-08-25T21:18:01.263Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Chromecast components within Google Chrome prior to version 152.0.7977.65.\nThis memory management flaw allows a remote attacker who has already compromised the renderer process to achieve arbitrary code execution outside the browser sandbox.\nThe vulnerability represents a severe security risk, as it permits an attacker to escape the restricted sandbox environment, potentially leading to full system compromise or persistence.\nExploitation requires the attacker to entice a user to visit a specially crafted HTML page, which triggers the memory corruption within the renderer process.\nGiven the 'Critical' severity rating assigned by Chromium, this vulnerability is considered highly dangerous and requires immediate remediation through version updates.",
  "technicalDetails": "The vulnerability is a use-after-free (UAF) condition within the Chromecast implementation in Google Chrome. Use-after-free vulnerabilities occur when an application continues to utilize a memory pointer after the associated memory block has been deallocated or freed.\nIn this specific instance, the flaw originates from improper memory lifecycle management within the Chromecast handling routines. When the renderer process manages objects associated with Chromecast operations, a race condition or logic error leads to a scenario where a pointer remains active after the underlying resource has been released.\nThe attack flow begins when an attacker directs a user to a malicious HTML page designed to interact with the vulnerable Chromecast component. By triggering specific operations within the renderer process, the attacker causes the application to maintain a reference to a freed memory heap location.\nBy then performing heap grooming or spray techniques, the attacker can influence the contents of the freed memory slot, replacing the original data with a malicious payload, such as a crafted object or an instruction pointer. When the application subsequently attempts to access the stale pointer, it inadvertently executes or interacts with the attacker-supplied data.\nThe critical impact of this vulnerability lies in its ability to facilitate sandbox escape. The renderer process in Google Chrome is sandboxed to prevent arbitrary system access. By exploiting this UAF vulnerability, the attacker can leverage the memory corruption to bypass sandbox restrictions and execute arbitrary code with elevated privileges, effectively breaking the security boundary between the web content and the host environment.\nThis vulnerability does not require authentication or specific user privileges beyond the ability to render the malicious HTML content within the browser. Once the memory corruption occurs, the attacker gains the ability to execute instructions in the context of the host process, potentially leading to unauthorized data access, system control, or further exploitation of the underlying operating system.\nThis issue affects all versions of Google Chrome prior to 152.0.7977.65. Successful exploitation relies on the browser's inability to safely manage object lifetimes within the complex multithreaded architecture of the Chromium renderer."
}