EUVD-2026-93793
GHSA-6v8g-jgvh-hh78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers use-after-free in Chromecast
-
ExploitReclaim freed memory with controlled data
-
ExecutionAchieve code execution and escape sandbox
-
ImpactRun arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using a vulnerable Chrome build (prior to 155.0.8059.39) to load attacker-controlled web content that exercises the Chromecast (Cast) component - the per CVSS UI:R, the sole hard prerequisite is this user interaction (visiting or rendering a crafted HTML page). No authentication, elevated privileges, or special target configuration is needed (PR:N, AC:L), and the Cast functionality is part of standard desktop Chrome rather than an optional feature. The limiting factors defenders can rely on are: (1) the user must be driven to malicious content, so it is not zero-click/wormable; (2) only Chrome versions below 155.0.8059.39 are affected, so patching fully remediates. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page, with a scope change reflecting that exploitation breaks out of the Chrome renderer sandbox to execute arbitrary code on the host - the single most dangerous class of browser bug. Chromium rated it Critical and a vendor patch is available (fixed in 155.0.8059.39). However, several real-world exploitation signals are MISSING: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit code (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one limiting factor is UI:R - a user must be lured to a malicious page - which slightly reduces mass-exploitation potential compared to a zero-click bug. Net assessment: treat as urgent patch priority given ubiquity of Chrome, sandbox-escape impact, and trivial attack complexity, while noting that no active exploitation or weaponized POC is confirmed in the provided data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Chromecast component, then lures a victim (via phishing link, malvertising, or compromised site) to visit it. When the page loads, the freed-then-reused memory is exploited to escape the renderer sandbox and run arbitrary code on the victim's machine. No public exploit code is identified at time of analysis, but the memory-corruption class and Critical rating make reliable exploitation feasible for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 155.0.8059.39 through a use-after-free flaw in the built-in Chromecast (Cast) component: an attacker who gets a victim to render a crafted HTML page can corrupt freed memory and run arbitrary code with the browser's privileges (CVSS 9.6, Chromium severity Critical). The sole hard prerequisite is user interaction - no credentials or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) - and because Cast ships with standard desktop Chrome rather than as an optional extension, the exposed population is essentially every unpatched Chrome installation. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Upgrade to Google Chrome 155.0.8059.39 or later - this is the vendor-released patch (patch status: available from vendor), and patching fully remediates the issue since only builds below that version are affected. On managed fleets, force an update check and verify the installed version rather than relying on background auto-update, because the fix was delivered via a stable channel push (see the release note at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the underlying bug at https://issues.chromium.org/issues/534994449). If immediate fleet-wide upgrade is not possible, the only meaningful compensating control is to shrink the attack surface by disabling the Chromecast/Cast and media-router functionality through enterprise policy, which removes the vulnerable component from reach but breaks casting and media-routing features for users and does not protect against other Chrome memory-corruption bugs - treat it as a stopgap with a defined end date, not a substitute for patching. Standard user-interaction defenses (blocking untrusted content, mail/web gateway filtering) reduce the likelihood of a victim reaching a malicious page but cannot be relied on against drive-by delivery, and because no public exploit code has been identified, the priority is closing the version gap before a proof-of-concept or weaponized exploit emerges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416), a memory-safety class in which an object is freed while a dangling pointer to it remains reachable; subsequent dereferencing lets an attacker control the contents of the reused memory and redirect execution. Here the defect lives in the Chromecast/Cast component that desktop Chrome uses for media routing and device discovery, and the per-CVSS scope change (S:C) combined with the C:H/I:H/A:H metrics indicates the attacker can escape the renderer sandbox rather than merely crash a tab - the malicious page supplies the crafted HTML that drives the vulnerable code path. Affected software is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the fixed boundary at 155.0.8059.39 (EUVD-2026-93793 lists affected versions as Chrome below 155.0.8059.39). Google's own bug is tracked publicly as Chromium issue 534994449, referenced alongside the stable-channel release note. Because the vulnerable component is part of the standard browser surface and exploitation requires only page rendering, memory-corruption bug classes of this kind in Chrome are historically prime targets for weaponization once a patch diff is public, even though no exploit has been observed for this specific CVE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N/AC:L) but required victim interaction (UI:R); sandbox escape changes scope (S:C) and yields full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome - the default browser on most corporate endpoints - contains a critical flaw in its built-in Chromecast component that allows an attacker to execute code with the browser's privileges, and because Cast ships with standard desktop Chrome rather than as an optional add-on, essentially every unpatched installation in the organization is exposed. A successful compromise could give an external attacker a foothold on employee workstations, with the potential for data theft, lateral movement, and disruption of business operations. Google has released a fixed build, so this risk is fully remediable through standard patch management rather than requiring architectural change.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB