CVE-2026-79054

CVE-2026-79054 is a use-after-free memory-corruption flaw (CWE-416) in the Chromecast component of Google Chrome. It is triggered when a user visits a crafted HTML page, but exploitation requires that the attacker has already compromised the renderer process, making this typically a second-stage or chained bug. A successful attacker executes arbitrary code outside of the browser sandbox, gaining code execution with privileges beyond Chrome's normal containment. All Google Chrome releases prior to 152.0.7977.65 are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Update Google Chrome to version 152.0.7977.65 or later, available via Chrome's built-in updater (check at chrome://settings/help); force a browser refresh across managed fleets and confirm updated versions on all endpoints. Because exploitation requires a compromised renderer, patching renderer-component flaws and keeping Chrome current overall is the primary mitigation; treat visits to untrusted pages as the exposure vector.