EUVD-2026-65767
GHSA-cgq2-gvwr-85hj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Kept AV:N/UI:R/S:C and full CIA for the sandbox escape but raised to AC:H because reliable exploitation demands a pre-existing renderer compromise plus heap grooming.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape via use-after-free in Google Chrome's Chromecast component lets a remote attacker who has already compromised the renderer process execute arbitrary code in the higher-privileged browser process, breaking out of the site-isolation sandbox. It affects Chrome desktop before 152.0.7977.65 and is triggered by luring a victim to a crafted HTML page (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the renderer process (a prior, separate renderer RCE or memory-corruption bug is a hard prerequisite - this CVE alone is only the sandbox-escape stage) and requires user interaction: the victim must open a crafted HTML page (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals must be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-level bug (via a malicious ad or compromised site) to gain code execution inside Chrome's sandboxed renderer, then serves a crafted HTML page that drives the Chromecast component into the use-after-free to escape the sandbox and run code in the browser process on the victim's host. No public exploit or KEV listing exists yet, and the multi-stage requirement plus AC/UI factors make opportunistic mass exploitation unlikely in the near term. |
| Remediation | Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; Chrome's built-in updater fetches this automatically, so ensure clients can auto-update and restart the browser to apply it (chrome://settings/help forces the check). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Chrome desktop installations using your endpoint management platform and identify current versions; communicate the critical nature of this vulnerability to leadership and confirm expedited patching authority if required by change control procedures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today