Description

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:14.047Z",
  "pubdate": "2026-08-25T21:18:14.047Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Chromecast component of Google Chrome versions prior to 152.0.7977.65.\nThe vulnerability originates from improper memory management within the Chromecast implementation, which can be triggered by a remote attacker via a maliciously crafted HTML page.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the confines of the browser's security sandbox.\nThe impact is categorized as High, as it permits the execution of unauthorized commands or malicious payloads without requiring user interaction beyond navigating to the crafted content.\nThis flaw presents a significant risk to confidentiality, integrity, and availability, as it effectively bypasses standard web security boundaries.\nDefense-in-depth strategies, including keeping browser software updated, are essential to mitigating the risk of exploitation.",
  "technicalDetails": "The vulnerability is a classic Use-After-Free (UAF) condition within the Chromecast integration module in Chromium. A UAF occurs when a program continues to use a pointer after the memory area it references has been deallocated or freed.\nIn this specific instance, the flaw resides in how the Chromecast component manages the lifecycle of objects related to media casting or discovery. If an attacker can force the application to deallocate an object while a dangling pointer to that object remains active in the application logic, they can trigger undefined behavior.\nThe attack vector requires the victim to render a specially crafted HTML page. When the browser processes this page, the attacker-controlled JavaScript or document structure interacts with the vulnerable Chromecast component, prompting a premature release of the memory object. Subsequent operations by the browser attempt to access the freed memory location, which the attacker has often groomed or re-allocated with malicious data.\nBy controlling the contents of the re-allocated memory, an attacker can redirect the application's execution flow. Since the browser's heap-spraying or memory-grooming techniques can place attacker-supplied shellcode or ROP (Return-Oriented Programming) chains into the memory previously occupied by the freed object, the execution flow is diverted to the malicious payload.\nWhile the exploitation occurs within the browser's sandbox, this remains a severe security failure. The attacker gains the ability to execute code with the permissions assigned to the renderer process. This typically includes access to the local user environment, the ability to interact with sensitive APIs, or the potential to facilitate further browser exploitation.\nThe root cause is a failure in the object reference counting or object lifetime management within the C++ implementation of the Chromecast component. Because this occurs in the rendering engine, it does not require authentication and can be triggered via standard web navigation.\nPost-exploitation impact includes persistent execution of malicious code, potential data theft from the browser context, or the use of the compromised process as a pivot point for broader system attacks if subsequent sandbox escape vulnerabilities are identified."
}