CVE-2026-79121

CVE-2026-79121 is an improper input validation flaw in the Chromecast component of Google Chrome that Google rates as a Critical Chromium security issue. It is triggered via a crafted HTML page, and the attacker must first have compromised the Chrome renderer process (typically with a separate renderer bug) before this flaw can be leveraged. Successfully exploiting it allows the attacker to break out of the Chrome sandbox and execute arbitrary code outside it, giving full process-level access on the victim's machine with the scope of the impact crossing the security boundary. Anyone running Google Chrome prior to 152.0.7977.65 is affected, spanning desktop and mobile installs where the casting feature ships by default. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at only 0.3%, so it is not currently known to be exploited in the wild.

What to do: Update Google Chrome to 152.0.7977.65 or later on all endpoints, using MDM/EDR reporting or managed-browser policies to verify fleet versions. Because exploitation requires a prior renderer-process compromise, treat this as a chainable privilege-escalation primitive and patch it promptly alongside any renderer bugs. There are no known workarounds beyond disabling casting or restricting untrusted web content, neither of which is practical, so patching is the primary mitigation.