CVE-2026-106382

Google Chrome versions before 155.0.8059.39 contain a use-after-free flaw (CWE-416) in the Chromecast component. A remote attacker can trigger it by getting a user to open a crafted HTML page, with no privileges required and low attack complexity. Successful exploitation can execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity, and availability (CVSS 3.1 9.6; Chromium severity Critical). Anyone still running an unpatched Chrome build is affected. There is no known public proof of concept and the issue is not in CISA KEV, so exploitation is not known to be in the wild.

What to do: Update Google Chrome to version 155.0.8059.39 or later on every device and confirm the installed version on the browser About page so the update has actually applied. Until then, avoid opening untrusted or unexpected web pages. No public exploit is known, but this is a critical sandbox-escape bug and should be patched immediately.