CVE-2026-7349: Google Chrome Cast Use-After-Free Flaw

CVE-2026-7349 Overview

A Use After Free vulnerability exists in the Cast component of Google Chrome prior to version 147.0.7727.138. This memory corruption flaw allows an attacker positioned on the local network segment to execute arbitrary code within Chrome's sandbox by sending malicious network traffic. The vulnerability is classified as CWE-416 (Use After Free) and has been rated as high severity by Chromium security.

Critical Impact

Attackers on the same network segment can exploit this vulnerability to achieve code execution inside Chrome's sandbox through crafted network packets targeting the Cast functionality.

Affected Products

• Google Chrome prior to version 147.0.7727.138
• Chromium-based browsers using the affected Cast component

Discovery Timeline

• 2026-04-28 - CVE-2026-7349 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7349

Vulnerability Analysis

This vulnerability is a Use After Free (UAF) condition within Chrome's Cast component, which handles media streaming functionality to Chromecast and compatible devices. Use After Free vulnerabilities occur when a program continues to reference memory after it has been freed, potentially allowing an attacker to manipulate the freed memory region and hijack program execution flow.

The Cast component processes network traffic from devices on the local network segment, making it accessible to adjacent network attackers without requiring user interaction or special privileges. While the vulnerability requires the attacker to be on the same network segment (such as the same WiFi network or LAN), no authentication is required to trigger the flaw.

The exploitation occurs within Chrome's sandbox environment, which provides some mitigation by limiting the attacker's initial access. However, successful exploitation could still lead to information disclosure, further sandbox escape attempts, or lateral movement within the sandboxed context.

Root Cause

The root cause is a memory management error in the Cast component where object references are not properly invalidated after the underlying memory has been deallocated. When the Cast component processes certain network traffic patterns, the code path may access a memory region that has already been freed, leading to undefined behavior that can be exploited for code execution.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the victim. The attack is initiated by sending malicious network traffic that triggers the vulnerable code path in the Cast component. No user interaction is required beyond having Chrome running with Cast functionality enabled. The attack does not require any authentication or privileges on the target system.

The exploitation flow involves:

1. Attacker positions themselves on the same local network as the target
2. Malicious network packets are crafted to trigger the Cast component vulnerability
3. The UAF condition is triggered when Chrome processes the malicious traffic
4. Attacker-controlled data occupies the freed memory region
5. Code execution occurs within Chrome's sandbox context

Detection Methods for CVE-2026-7349

Indicators of Compromise

• Anomalous network traffic patterns targeting Chrome Cast protocols on the local network
• Chrome browser crashes or unexpected behavior related to Cast functionality
• Memory corruption indicators in Chrome crash reports referencing the Cast component

Detection Strategies

• Monitor for unusual mDNS or SSDP traffic that may indicate Cast protocol abuse
• Deploy network-based intrusion detection rules to identify malformed Cast protocol messages
• Enable Chrome crash reporting and monitor for UAF-related crashes in the Cast component
• Implement endpoint detection rules to identify suspicious Chrome process behavior

Monitoring Recommendations

• Configure network monitoring to alert on abnormal Cast-related traffic volumes or patterns
• Review Chrome crash logs for evidence of memory corruption in Cast-related code paths
• Monitor for lateral movement attempts following potential exploitation on local network segments

How to Mitigate CVE-2026-7349

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.138 or later immediately
• Verify all Chromium-based browsers in your environment are updated to patched versions
• Consider temporarily disabling Cast functionality in Chrome via enterprise policies if immediate patching is not possible
• Implement network segmentation to limit adjacent network attack surface

Patch Information

Google has released Chrome version 147.0.7727.138 which addresses this vulnerability. The update is available through Chrome's standard automatic update mechanism. Enterprise administrators should deploy the update through their software management systems. For detailed release information, see the Google Chrome Update Announcement. Additional technical details can be found in the Chromium Issue Tracker Entry.

Workarounds

• Disable Google Cast functionality via Chrome enterprise policies using EnableMediaRouter set to false
• Implement network segmentation to isolate endpoints from untrusted adjacent network devices
• Deploy network-level controls to filter suspicious Cast protocol traffic
• Consider using browser isolation solutions to contain potential sandbox escapes

# Chrome Enterprise Policy Configuration to Disable Cast
# Add to Chrome policy configuration
{
  "EnableMediaRouter": false
}