CVE-2026-79202: Google Chrome Chromecast Use After Free Flaw

CVE-2026-79202 Overview

CVE-2026-79202 is a use-after-free vulnerability in the Chromecast component of Google Chrome prior to version 152.0.7977.65. A remote attacker can exploit the flaw by serving a crafted HTML page, leading to arbitrary code execution inside the Chrome sandbox. The Chromium project rates the security severity as High. Exploitation requires user interaction, such as visiting a malicious web page. The weakness is tracked as CWE-416.

Critical Impact
Successful exploitation allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Chromecast component
Systems where Chrome's Chromecast/media routing feature is enabled

Discovery Timeline

2026-08-25 - CVE-2026-79202 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79202

Vulnerability Analysis

The vulnerability resides in the Chromecast subsystem of Google Chrome. Chromecast handles media routing and device discovery for casting content from the browser to external displays. A use-after-free condition occurs when the component references memory that has already been freed, allowing an attacker to influence the contents of the reclaimed allocation.

An attacker hosts a crafted HTML page that triggers the specific sequence of Chromecast operations required to release and then reuse the affected object. Because the flaw is reachable from web content, exploitation requires only that a user navigate to attacker-controlled content. Successful exploitation yields arbitrary code execution inside the Chrome sandbox, providing a foothold that a chained sandbox escape could extend into full system compromise.

Root Cause

The root cause is improper management of object lifetime within the Chromecast component, categorized under CWE-416: Use After Free. Code paths continue to access a pointer after the underlying object has been freed, allowing memory contents to be controlled by attacker-influenced allocations. See Chromium Issue #521285077 for tracking details.

Attack Vector

The attack vector is network-based through a crafted HTML page. The attacker delivers the exploit by convincing the target to visit a malicious website or by injecting the payload into a compromised page. No prior authentication is required, but user interaction is necessary to load the page. Technical details are not fully disclosed pending broader patch adoption. Refer to the Google Chrome Stable Update for release notes.

Detection Methods for CVE-2026-79202

Indicators of Compromise

Chrome renderer or utility process crashes with heap corruption signatures shortly after visiting an untrusted page
Outbound connections from Chrome child processes to unexpected IP addresses following page loads with Chromecast activity
Unexpected child process creation from chrome.exe correlated with browsing sessions
Browser telemetry showing Chromecast media router invocations from unusual domains

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Monitor endpoint process trees for anomalous children spawned by Chrome renderer processes
Correlate Chrome crash dumps referencing Chromecast or media router modules with browsing history
Deploy web content filtering to block newly observed domains hosting suspected exploit pages

Monitoring Recommendations

Enable and centralize Chrome crash reporting to identify recurring faults in Chromecast code paths
Ingest endpoint browser telemetry into a security data lake for retrospective hunting once exploit indicators become public
Track Chrome update compliance as a continuous KPI rather than a point-in-time check
Alert on script-heavy pages invoking the Presentation API or Remote Playback API from low-reputation origins

How to Mitigate CVE-2026-79202

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Force browser restarts through management tooling to ensure the patch is loaded into running processes
Audit Chromium-based browsers and embedded frameworks for downstream patch availability
Restrict user browsing to trusted sites for high-risk roles until patching is complete

Patch Information

Google released the fix in the Chrome Stable Channel update documented at the Google Chrome Stable Update advisory. Administrators should deploy Chrome 152.0.7977.65 or newer through enterprise update channels such as Google Update, Microsoft Intune, or Jamf. Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi will require separate updates once their maintainers integrate the upstream fix.

Workarounds

Disable the Chromecast media router via enterprise policy where casting is not required for business use
Apply the EnableMediaRouter policy set to false to reduce exposure of the vulnerable component
Use site isolation and strict content policies to limit the impact of renderer-level exploitation
Segment high-value user workstations from arbitrary internet browsing during the rollout window

bash

# Example Chrome enterprise policy to disable the media router
# Windows registry path
# HKLM\Software\Policies\Google\Chrome\EnableMediaRouter = 0

# macOS plist example
defaults write com.google.Chrome EnableMediaRouter -bool false

# Linux managed policy JSON (/etc/opt/chrome/policies/managed/chromecast.json)
{
  "EnableMediaRouter": false
}