CVE-2026-87628

CVE-2026-87628 is a use-after-free (CWE-416) in the Cast component of Google Chrome, rated Critical by Chromium, that is triggered when the browser processes crafted network traffic sent by an attacker on an adjacent network (e.g., the same LAN segment). A successful attack can allow the adjacent attacker to execute arbitrary code outside the Chrome sandbox, a stronger outcome than typical renderer-only bugs because it escapes Chrome's containment model. All Google Chrome versions prior to 153.0.8010.36 are affected; the flaw is fixed in Chrome 153.0.8010.36, part of the Chrome 153 release that ships 230 security fixes. No public proof-of-concept is known, the bug is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so there is no known exploitation of this specific Cast bug. Note that the actively exploited zero-day in the Chrome 153 headlines is a separate V8 flaw that allows code execution only inside the sandbox, and should not be confused with this outside-the-sandbox Cast issue.

What to do: Update Chrome to 153.0.8010.36 or later on all managed endpoints and verify the version via chrome://settings/help; the high EPSS-adjacent attack requirement means hosts on shared, corporate, or otherwise untrusted LANs should be prioritized. As an interim mitigation, restrict unsolicited Cast/mDNS-style traffic to endpoints on untrusted network segments. Patch urgently regardless, since the same Chrome 153 release also fixes a separately reported V8 zero-day that was exploited in the wild.