EUVD-2026-105545
GHSA-m87q-xfcv-792v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Chromecast use-after-free
-
ExecutionReclaim freed object with controlled data
-
ImpactGain code execution within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (prior to 156.0.8078.47) that exercises the Chromecast component - i.e., user interaction (UI:R) in the form of visiting a crafted page is mandatory, so this cannot be triggered passively without victim action. The flaw is remotely reachable with no authentication (PR:N) against default Chrome installations, but a critical LIMITING factor is that code execution is contained within the browser sandbox (S:U, 'inside the sandbox'); a full host compromise additionally requires chaining a separate sandbox-escape vulnerability. Risk is further reduced for users on the patched Stable channel. |
| Impact | Signals conflict on priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) treats this as a remote, unauthenticated, low-complexity code-execution flaw, but the description explicitly scopes execution to 'inside the sandbox,' meaning the vector's C:H/I:H/A:H reflects compromise of the sandboxed renderer process rather than the host - consistent with S:U (no scope change / no sandbox escape). Google's own Chromium rating is 'Medium,' which is materially lower than the 8.8 and better matches a sandbox-contained UAF that still requires user interaction (visiting a crafted HTML page). No EPSS score was provided; the CVE is not listed in CISA KEV; and no public exploit or POC is referenced, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: this is a patch-promptly browser memory-corruption bug, not an emergency - it is genuinely remotely reachable and low-complexity, but mitigated by required user interaction and sandbox containment, and lacks the KEV/EPSS/POC signals that would elevate it to active-threat priority. The CVSS 8.8 High versus vendor 'Medium' discrepancy should be reconciled against the fact that RCE is sandbox-confined. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, compromised ad, or iframe) that triggers the use-after-free in the Chromecast component when a victim running a vulnerable Chrome build loads it. Successful exploitation yields arbitrary code execution confined to the browser sandbox, which an attacker would typically chain with a separate sandbox-escape bug to reach the host. No public exploit or POC is referenced for this CVE at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Chromecast component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page on any build prior to 156.0.8078.47. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms mandatory user interaction, and the impact is bounded by Chrome's renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape flaw. Priority signals conflict - Chromium rates the issue Medium while the derived CVSS is 8.8 - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security contact and restricts technical detail in the tracker.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Update immediately to 156.0.8078.47 or later through the browser's built-in updater (chrome://settings/help) or your managed software-deployment channel, then fully restart Chrome so the new binary is loaded - on managed fleets, verify the reported version rather than relying on update-policy compliance alone, and consult the Stable Channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. No documented feature toggle specific to this defect was published, but organizations that cannot patch within their normal window can reduce exposure by disabling the Cast/media-router component via the Chrome Enterprise policy EnableMediaRouter=0, accepting the side effect that all Cast and media-router functionality stops working for users; restricting browsing to a hardened, auto-updated browser image offers partial risk reduction only, since the flaw is reachable from ordinary web content and cannot be reliably blocked by URL filtering or by blocking Cast network ports. Treat any suspected exploitation as renderer-contained: hunt for anomalous renderer crashes and post-exploitation sandbox-escape attempts, because a standalone trigger of this bug should not by itself yield host-level code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, in Chrome's Chromecast support - the media-router/casting subsystem that discovers Cast devices and negotiates media sessions with attacker-influenced data. A freed heap object remains referenced, and a crafted HTML page that drives the Chromecast code path through the renderer can reallocate the freed memory with attacker-controlled contents, producing a dangling-pointer write/read that corrupts memory and yields arbitrary code execution within the compromised renderer process. Because the flaw sits in a browser subsystem reachable from web content, the attack surface is effectively every default Chrome installation that has not updated past 156.0.8078.47; the EUVD record lists the affected range as builds below that fixed release. Notably, code execution is contained 'inside the sandbox' (S:U in the assessed vector), so a successful exploit yields renderer-level control, not operating-system-level access, unless a second, independent sandbox-escape vulnerability is chained. Google's Chromium severity rating of Medium reflects this containment and the required user interaction, which is why it diverges from the 8.8 CVSS base score driven by high confidentiality, integrity, and availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via crafted HTML with no auth (AV:N/PR:N) but requires the victim to load the page (UI:R); sandbox-confined so S:U, with high renderer-process C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Chromecast component; a remote unauthenticated attacker could execute code inside the browser sandbox if a user opens a crafted HTML page. Leadership should care because Chrome is widely deployed and user interaction limits but does not eliminate exposure, while the sandbox constrains impact unless chained with a separate escape; no public exploit identified at time of analysis and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB