CVE-2026-79224

Google Chrome versions prior to 152.0.7977.65 contain a use-after-free vulnerability (CWE-416) in the Chromecast component, rated Critical by Chromium. An attacker can trigger it by luring a user to a crafted HTML page (user interaction is required) and, after having compromised the renderer process, abuse the memory corruption to break out of Chrome's sandbox. Successful exploitation yields arbitrary code execution outside the sandbox, meaning code runs with the privileges of the browser's host process rather than the confined renderer, with high confidentiality, integrity and availability impact. All users running an affected Chrome build are potentially exposed, although the attack chain requires the attacker to already control the renderer process. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Update Google Chrome to 152.0.7977.65 or later immediately; since Chrome auto-updates, verify the running version via chrome://version or the About Chrome menu. Users of Chromium-based browsers that bundle the same code should apply their vendor's corresponding updates as they are released. Given the required prior renderer compromise, prompt patching and avoiding untrusted web pages remain the primary mitigations.