EUVD-2026-65767
GHSA-cgq2-gvwr-85hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior bug
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Chromecast component
-
ExecutionReclaim freed object, hijack control flow
-
ImpactExecute code in browser process outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process (a prior, separate renderer RCE or memory-corruption bug is a hard prerequisite - this CVE alone is only the sandbox-escape stage) and requires user interaction: the victim must open a crafted HTML page (UI:R). It targets the Chromecast/Cast component, so environments where Cast is exercised are the relevant surface, and the fix boundary is Chrome < 152.0.7977.65. Limiting factors that reduce realistic risk: the mandatory prior renderer compromise, the required user interaction, low EPSS (0.33%), SSVC Automatable=no, and no observed in-the-wild exploitation. |
| Impact | The signals must be read together. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the scope change and full CIA impact of a sandbox escape. However, the description makes clear this is the second stage of a chain: it requires an attacker who has ALREADY compromised the renderer process, so the PR:N/AC:L framing reflects Chrome's convention of scoring from the malicious-page perspective rather than the real precondition of a prior renderer bug - a notable tension between the vector and the description. Corroborating lower real-world urgency: EPSS is only 0.33% (25th percentile), CISA SSVC lists Exploitation=none and Automatable=no (Technical Impact=total), it is NOT in CISA KEV, and no POC is referenced. Net: a genuinely severe primitive if chained, but not an emergency - handle via normal Chrome patch cadence unless there is evidence of active chaining. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level bug (via a malicious ad or compromised site) to gain code execution inside Chrome's sandboxed renderer, then serves a crafted HTML page that drives the Chromecast component into the use-after-free to escape the sandbox and run code in the browser process on the victim's host. No public exploit or KEV listing exists yet, and the multi-stage requirement plus AC/UI factors make opportunistic mass exploitation unlikely in the near term. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox escape via use-after-free in Google Chrome's Chromecast component lets a remote attacker who has already compromised the renderer process execute arbitrary code in the higher-privileged browser process, breaking out of the site-isolation sandbox. It affects Chrome desktop before 152.0.7977.65 and is triggered by luring a victim to a crafted HTML page (UI:R). No public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile) and CISA SSVC records exploitation status 'none'.
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; Chrome's built-in updater fetches this automatically, so ensure clients can auto-update and restart the browser to apply it (chrome://settings/help forces the check). Track deployment via the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html and the tracker at https://issues.chromium.org/issues/513261751. If patching is delayed, reduce exposure by limiting the Cast feature and blocking untrusted browsing, but note Cast cannot be fully disabled with a single flag on all versions and site-blocking harms usability; because the bug requires a pre-existing renderer compromise, keeping site isolation enabled and general renderer hardening (never run with --no-sandbox, keep the OS current) meaningfully lowers the chance the chain completes. Users of other Chromium-based browsers should apply their vendor's equivalent update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in the Chromecast (Cast/media-router) subsystem of Chromium, the open-source engine underlying Google Chrome (CPE cpe:2.3:a:google:chrome). Chrome enforces a multi-process security model in which untrusted web content runs in a sandboxed renderer; components like Chromecast that broker between the renderer and the browser process are a classic sandbox-escape surface. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to reclaim the freed object and hijack control flow - here within the more-privileged browser process, which is why scope changes (S:C) and the outcome is code execution outside the sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Kept AV:N/UI:R/S:C and full CIA for the sandbox escape but raised to AC:H because reliable exploitation demands a pre-existing renderer compromise plus heap grooming.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions below 152.0.7977.65 are vulnerable to CVE-2026-78939, a critical sandbox escape that allows attackers who lure users to malicious websites to execute code in the browser process and bypass Chrome's site isolation protections. This vulnerability could enable theft of credentials, authentication tokens, and sensitive corporate data accessed within the browser. Immediate patching across all Chrome desktop deployments is required.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB