Google Chrome EUVD-2026-65967

Two specific prerequisites must both be satisfied for exploitation: (1) the victim must be running Google Chrome prior to version 152.0.7977.65 on any desktop platform, and (2) the attacker must have already achieved a renderer process compromise - this UAF is a sandbox escape step within a chained attack, not a standalone entry point. User interaction is required (UI:R): the victim must visit or be redirected to a crafted HTML page that triggers the vulnerable Chromecast code path. No authentication or local privileges are required from the attacker's perspective (PR:N), but the renderer pre-compromise is a substantial technical barrier that limits exploitation to threat actors capable of chaining multiple browser vulnerabilities. Exploitation is limited to desktop Chrome; Chromium-based browsers and mobile Chrome are not explicitly addressed by the advisory.

The CVSS 8.3 score with changed scope and full C/I/A impact accurately captures theoretical severity - successful exploitation yields arbitrary code execution outside Chrome's sandbox. Multiple signals constrain real-world urgency, however: AC:H encodes that the renderer must already be compromised, making this the second stage of a chained attack rather than a standalone foothold. EPSS at 0.33% (25th percentile) and SSVC 'Exploitation: none' both confirm no observed in-the-wild use at time of analysis; SSVC 'Automatable: no' further reinforces that mass, scripted exploitation is not feasible without a preceding renderer exploit. The SSVC 'Technical Impact: total' rating remains the sobering counterweight - when the conditions align, the attacker achieves full sandbox escape. Security teams should treat this as an urgent patch given the total impact potential, while recognizing the chained prerequisite substantially narrows the realistic attacker pool compared to a standalone unauthenticated RCE.

An attacker who has already compromised a Chrome renderer process - for example, by exploiting a separate renderer-level vulnerability via a malicious or attacker-controlled website - serves a crafted HTML page that triggers the Chromecast use-after-free bug in the browser process. By manipulating freed heap memory, the attacker redirects execution flow outside Chrome's sandbox and achieves arbitrary code execution at the host process privilege level. No public exploit or proof-of-concept demonstrating this chain has been identified at time of analysis.