CVE-2026-15902: Google Chrome Cast Use After Free Flaw

CVE-2026-15902 Overview

CVE-2026-15902 is a use-after-free vulnerability in the Cast component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.128 and allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. Chromium classifies the security severity as High, and the NVD assigns a CVSS 3.1 base score of 9.6. Exploitation requires user interaction, such as visiting a malicious web page, but no privileges or authentication. The underlying weakness is tracked as CWE-416: Use After Free.

Critical Impact
A remote attacker can achieve arbitrary code execution inside the Chrome sandbox by luring a user to a crafted HTML page that triggers the Cast use-after-free.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.128
Chromium-based browsers that embed the vulnerable Cast component
Chrome Stable Channel builds released before the July 2026 update

Discovery Timeline

2026-07-20 - CVE-2026-15902 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15902

Vulnerability Analysis

The vulnerability resides in Chrome's Cast subsystem, which handles media casting to remote receivers such as Chromecast devices. A use-after-free condition occurs when the component references heap memory after that memory has been released. An attacker who controls the object layout on the heap can influence which data occupies the freed region. When Chrome later dereferences the dangling pointer, the attacker gains control over program flow within the renderer or Cast process.

The vulnerability is reachable from web content, meaning a crafted HTML page can invoke the Cast APIs required to trigger the flaw. The attack scope is marked as changed, indicating that successful exploitation impacts resources beyond the initially compromised component. Chromium's advisory notes that code execution occurs inside a sandbox, so a separate sandbox escape would be required to reach the host operating system.

The EPSS score is 0.409%, placing the vulnerability in the 33rd percentile for near-term exploitation likelihood. No public exploit code or CISA KEV listing is currently associated with this CVE.

Root Cause

The root cause is improper object lifetime management in the Cast component [CWE-416]. Code paths retain a pointer to a Cast-related object after the object has been freed, likely due to a missing reference count increment, a race between asynchronous callbacks and destruction, or an unsafe raw pointer held across a task boundary. Subsequent access to the freed memory allows attacker-controlled data to be interpreted as a valid object.

Attack Vector

Exploitation is remote and requires user interaction. The attacker hosts a malicious page that invokes JavaScript APIs interacting with Cast functionality. When a victim loads the page in a vulnerable Chrome build, the crafted sequence frees an internal object and then triggers a code path that reuses it. Successful heap grooming leads to arbitrary code execution within the sandboxed renderer or Cast process. Refer to the Chromium Issue Tracker Entry for further technical context.

Detection Methods for CVE-2026-15902

Indicators of Compromise

Chrome renderer or utility process crashes with heap corruption signatures on pages that invoke Cast APIs
Unexpected child processes spawned by chrome.exe shortly after browsing untrusted content
Outbound connections from Chrome processes to non-standard Cast receiver endpoints on unusual ports

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.128
Enable browser crash telemetry and alert on repeated renderer or Cast utility crashes tied to specific URLs
Correlate web proxy logs with browser telemetry to identify users visiting suspicious pages that reference chrome.cast or PresentationRequest APIs

Monitoring Recommendations

Ingest Chrome enterprise reporting events into a SIEM to track version drift and crash reports
Monitor endpoint process trees for anomalous child processes launched by Chrome after visiting external sites
Track DNS and TLS SNI logs for connections to newly registered domains delivering casting-themed lures

How to Mitigate CVE-2026-15902

Immediate Actions Required

Update Google Chrome to version 150.0.7871.128 or later on all Windows, macOS, and Linux endpoints
Force browser restart through enterprise policy to ensure the patched binary is loaded
Audit third-party Chromium-based browsers and apply corresponding vendor updates as they become available

Patch Information

Google addressed the vulnerability in the Chrome Stable Channel update that ships version 150.0.7871.128. Details are published in the Chrome Stable Channel Update release notes. Enterprises using managed updates should confirm rollout status through Chrome Browser Cloud Management or equivalent tooling.

Workarounds

Disable the Cast feature via the EnableMediaRouter enterprise policy set to false where casting is not required
Restrict access to untrusted web content through URL filtering or isolated browsing until patching completes
Apply site isolation and strict same-origin policies through existing Chrome enterprise controls

bash

# Configuration example: disable Media Router (Cast) via Chrome enterprise policy
# Windows registry
reg add "HKLM\Software\Policies\Google\Chrome" /v EnableMediaRouter /t REG_DWORD /d 0 /f

# macOS (as plist entry)
defaults write com.google.Chrome EnableMediaRouter -bool false

# Linux (JSON policy under /etc/opt/chrome/policies/managed/)
# {
#   "EnableMediaRouter": false
# }