CVE-2026-79054: Google Chrome Use After Free Vulnerability

CVE-2026-79054 Overview

CVE-2026-79054 is a use-after-free vulnerability [CWE-416] in the Chromecast component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 on desktop platforms. An attacker who has already compromised the renderer process can leverage the bug to execute arbitrary code outside the browser sandbox using a crafted HTML page. Google classifies the Chromium security severity as Critical, while the CVSS 3.1 base score is 8.3 (High). Successful exploitation results in a sandbox escape, giving the attacker code execution at the privilege level of the browser process.

Critical Impact
Renderer-compromised attackers can escape the Chrome sandbox and execute arbitrary code on the host through the Chromecast component.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Chromecast component
Chrome installations on Windows, macOS, and Linux running impacted builds

Discovery Timeline

2026-08-25 - CVE-2026-79054 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database
2026-08 - Google releases Stable Channel update addressing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-79054

Vulnerability Analysis

The vulnerability is a use-after-free condition within Chrome's Chromecast implementation. Use-after-free bugs occur when a program continues to reference memory after it has been freed, allowing the memory region to be reused for attacker-controlled data. When the dangling pointer is dereferenced, the attacker can influence control flow, corrupt object structures, or achieve arbitrary code execution.

In this case, the Chromecast component runs in the browser process context, which sits outside the renderer sandbox. Chrome's security model isolates untrusted web content inside sandboxed renderer processes and restricts privileged operations to the browser process. A use-after-free reachable from a compromised renderer bridges that trust boundary. See the Chromium Issue Tracker #516764384 for the tracking record.

Root Cause

The root cause is improper object lifetime management in the Chromecast code path. A referenced object is released while another code path retains a pointer to it, and subsequent access to that pointer operates on freed memory. Attackers can groom the heap to place controlled data at the freed allocation, converting the dangling reference into a type confusion or arbitrary write primitive.

Attack Vector

Exploitation requires two conditions. First, the attacker must already control a renderer process, typically through a separate renderer bug or a malicious page delivering a chained exploit. Second, the victim must interact with a crafted HTML page that triggers the vulnerable Chromecast code path. The scope change reflects that a compromised renderer breaks out into the higher-privileged browser process, escaping the sandbox and enabling arbitrary code execution on the host.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79054

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, scripting engines, or LOLBins immediately after navigation events
Anomalous outbound network connections initiated by chrome.exe following Chromecast-related activity
Unexpected file writes, persistence entries, or credential access originating from the Chrome browser process
Crash reports or WerFault.exe events referencing the Chromecast component in Chrome versions below 152.0.7977.65

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 152.0.7977.65
Correlate browser process telemetry with post-exploitation behaviors such as process injection, token manipulation, or suspicious module loads
Monitor for chained renderer exploitation patterns, including sandbox escape indicators like renderer processes making IPC calls followed by browser-process anomalies

Monitoring Recommendations

Enforce EDR visibility into browser process trees and command-line arguments
Ingest Chrome crash telemetry into the SIEM and alert on Chromecast-related faults
Track browser version compliance through configuration management or vulnerability scanning tools

How to Mitigate CVE-2026-79054

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop endpoints
Restart Chrome after patch deployment to ensure the updated binary is loaded into memory
Audit Chromium-based browsers and embedded Chromium runtimes for the same underlying component and apply upstream fixes
Restrict browser extension installation and site permissions that could deliver a renderer exploit chain

Patch Information

Google addressed CVE-2026-79054 in the Stable Channel update announced in the Google Chrome Stable Update advisory. Administrators should ensure Chrome auto-update is enabled and validate deployment through management policies. Enterprises using Chrome Browser Cloud Management or group policy should push the updated version and verify installation across managed endpoints.

Workarounds

No official workaround replaces the patch; upgrading to the fixed version is required
Where patching is delayed, reduce exposure by limiting user browsing to trusted sites and disabling Chromecast-related features via enterprise policy
Enforce site isolation and strict extension controls to reduce the likelihood of renderer compromise as a precursor to sandbox escape

bash

# Verify Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version

# Enforce minimum version via enterprise policy (example JSON)
{
  "BrowserSwitcherEnabled": false,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}