Google Chrome CVE-2026-79054

Exploitation requires two conditions to be met sequentially: first, the attacker must have already achieved code execution within Chrome's renderer process via a separate, unspecified vulnerability; second, the victim user must navigate to or be directed to a crafted HTML page while the renderer is under attacker control (UI:R). The Chromecast component must be active or accessible in the browser. The AC:H CVSS metric reflects this chained prerequisite - standalone exploitation of this UAF without a prior renderer compromise is not possible. Limiting factors include: the requirement for user interaction, high attack complexity due to the two-stage chain, and the need for a separate renderer exploit. Platforms without Chromecast support or where the feature is administratively disabled would not be exploitable.

The CVSS base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects the high potential impact of a full sandbox escape, but AC:H and the implicit requirement for a pre-compromised renderer significantly reduce the realistic attacker population. EPSS at 0.46% (38th percentile) aligns with this assessment - exploitation is theoretically possible but has not materialized in broad automated campaigns. SSVC labels exploitation as 'none' currently and automatable as 'no,' which is consistent with the chained exploitation requirement. Technical impact is rated 'total,' correctly capturing the consequences of a successful sandbox escape. No KEV listing and no public POC exist at time of analysis. The severity is real and urgent for high-value targets, but this is not the class of vulnerability where unsophisticated attackers launch mass campaigns - rather, it fits the profile of targeted attacks by well-resourced threat actors using Chrome exploit chains.

An attacker first exploits a separate Chrome renderer vulnerability to gain code execution within the sandboxed renderer process. They then serve a crafted HTML page triggering the use-after-free in the Chromecast component, causing Chrome to reference attacker-controlled memory and redirecting execution outside the sandbox. Successful exploitation yields arbitrary code execution with the privileges of the Chrome browser process on the host OS.