Description

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:16.530Z",
  "pubdate": "2026-08-25T21:18:16.530Z",
  "executiveSummary": "This vulnerability is a critical use-after-free defect identified within the Chromecast component of Google Chrome. The flaw resides in the handling of object lifecycles, where a reference to memory is improperly maintained after its deallocation. An attacker who has already successfully compromised the renderer process can leverage this vulnerability to achieve arbitrary code execution outside the security sandbox.\nThe impact of this vulnerability is severe, as it facilitates a sandbox escape, allowing an attacker to move beyond the restricted renderer environment into the broader system context. This effectively undermines the browser's security architecture. Given the 'Critical' severity rating by the Chromium project, successful exploitation could lead to total system compromise, unauthorized data access, or the execution of malicious payloads on the underlying device.\nThe exploitation requirement involves an attacker gaining initial control over the renderer process, typically through a secondary exploit or chain, followed by the delivery of a specially crafted HTML page. Once the renderer is compromised, the vulnerability provides the necessary primitive to bypass sandbox constraints, necessitating immediate attention to patching and version management.",
  "technicalDetails": "The vulnerability is categorized as a use-after-free (UAF) condition within the Chromecast implementation of Google Chrome. A UAF vulnerability occurs when an application continues to use a pointer to a memory location after that memory has been freed or reallocated. In the context of the Chromium engine, this typically involves a race condition or a failure in the object's reference counting mechanism, leading to a dangling pointer.\nWhen a web page containing maliciously crafted HTML is processed by the renderer, it can trigger the faulty code path responsible for managing Chromecast-related objects. If the renderer process manages these objects incorrectly, an attacker can manipulate the heap state to influence the contents of the freed memory. By carefully grooming the heap, an attacker can replace the freed memory block with a controlled payload before the dangling pointer is accessed.\nThe attack flow proceeds as follows: First, the attacker compromises the renderer process, likely through a separate vulnerability such as a logic bug or memory corruption within the browser's JavaScript engine. Once inside the renderer, the attacker loads a crafted HTML document that initiates interaction with the vulnerable Chromecast component. Through specific asynchronous operations or event triggers, the attacker forces the component to deallocate a specific object while retaining a reference to it.\nSubsequently, the attacker uses the dangling pointer to perform an operation on the now-reallocated memory. By filling this memory with controlled data, the attacker can hijack control flow, such as overwriting function pointers or object vtables. When the application later attempts to use the dangling pointer, it unknowingly executes the attacker-supplied data or redirects execution to an arbitrary memory address, such as a ROP chain or shellcode.\nThis vulnerability is specifically dangerous because it grants the attacker the ability to execute arbitrary code outside the renderer's security sandbox. The sandbox is a primary defense mechanism designed to restrict the impact of renderer-level exploits by limiting access to system resources and sensitive APIs. By escaping this environment, the attacker gains a significantly higher level of privilege, effectively breaking the browser's process isolation model and impacting the underlying operating system or device firmware."
}