CVE-2026-79121: Google Chrome Chromecast RCE Vulnerability

CVE-2026-79121 Overview

CVE-2026-79121 is an improper input validation vulnerability [CWE-20] in the Chromecast component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to execute arbitrary code outside the Chrome sandbox. Chromium classifies the underlying security severity as Critical. The flaw enables a sandbox escape, one of the most consequential outcomes in a browser exploit chain, because it lifts attacker code from a constrained renderer into the broader browser process context.

Critical Impact
Sandbox escape via Chromecast allows arbitrary code execution outside the renderer, enabling full browser compromise when chained with a renderer exploit.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based builds shipping the vulnerable Chromecast component
Downstream browsers embedding the affected Chromium release train

Discovery Timeline

2026-08-25 - CVE-2026-79121 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79121

Vulnerability Analysis

The vulnerability resides in Chrome's Chromecast integration, which handles media casting between the browser and external Cast receivers. Chromecast code processes structured input originating from web content and the renderer process. Improper validation of this input allows a compromised renderer to pass malformed data into a more privileged process boundary.

Because Chromecast components run outside the renderer sandbox, successful exploitation gives attacker-controlled code the ability to execute in a higher-privileged context. This escalation converts a renderer-only compromise into a full browser process compromise, which typically enables persistent code execution, credential theft from browser storage, and lateral movement into the host operating system.

Exploitation requires an already compromised renderer, high attack complexity, and user interaction such as visiting an attacker-controlled page. The scope changes because the exploited component crosses a privilege boundary.

Root Cause

The root cause is missing or insufficient validation of input crossing the renderer-to-Chromecast trust boundary. Inter-process communication (IPC) messages accepted by the Chromecast handler are not fully sanitized before use, allowing a malicious renderer to supply values that the Chromecast component processes unsafely.

Attack Vector

An attacker delivers a crafted HTML page that first exploits a separate renderer vulnerability to gain code execution inside the sandboxed renderer process. From that foothold, the attacker sends malformed messages to the Chromecast component, triggering the input validation flaw and achieving code execution outside the sandbox. This two-stage pattern is standard in modern Chrome exploit chains.

No public proof-of-concept is available for CVE-2026-79121. See the Chromium Issue Tracker #516777082 for the tracked defect and the Google Chrome Stable Update advisory for release notes.

Detection Methods for CVE-2026-79121

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, powershell.exe, or scripting hosts shortly after visiting an untrusted page
Unexpected outbound network connections from chrome.exe to non-standard destinations following media cast interactions
Chrome versions below 152.0.7977.65 observed in endpoint inventory data
Anomalous file writes or persistence artifacts created under user profile paths by the Chrome process tree

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build older than 152.0.7977.65
Alert on Chrome renderer or utility processes performing behaviors inconsistent with browsing, such as loading LOLBins or writing executables
Correlate browser process anomalies with recent navigation events to identify likely drive-by exploitation attempts

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized data lake and build detections for Chrome sandbox-escape behavioral patterns
Monitor Chromecast and media routing feature usage in enterprise environments where casting is not required
Track Google Chrome stable channel advisories and enforce automated update compliance

How to Mitigate CVE-2026-79121

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded across all processes
Audit managed browser deployments and enforce update policies through group policy or MDM
Prioritize patching for users who browse untrusted content or handle sensitive credentials

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for release details. Chromium-based browser vendors should incorporate the upstream fix into their respective release trains.

Workarounds

Disable Chromecast and media routing features via enterprise policy where casting functionality is not required
Restrict browsing to trusted sites through URL filtering while patch deployment is in progress
Enforce site isolation and standard Chrome hardening settings to raise exploitation cost

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows PowerShell: check installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy example (Windows registry) to disable media router / Chromecast
# HKLM\SOFTWARE\Policies\Google\Chrome\EnableMediaRouter = 0 (DWORD)