CVE-2026-79292: Google Chrome Chromecast RCE Vulnerability

CVE-2026-79292 Overview

CVE-2026-79292 is an integer overflow vulnerability in the Chromecast component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can leverage the flaw to execute arbitrary code outside the Chrome sandbox by delivering a crafted HTML page. Google's Chromium security team classified the issue as High severity. The vulnerability is tracked under [CWE-190] (Integer Overflow or Wraparound) and requires user interaction combined with a prior renderer compromise, making it typically the second stage in a browser exploit chain.

Critical Impact
Successful exploitation escapes the Chrome sandbox and grants code execution in a higher-privileged browser process, opening a path to full host compromise.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Chromecast component
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79292 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79292

Vulnerability Analysis

The vulnerability resides in the Chromecast integration inside Google Chrome. Chromecast handles media casting between the browser and remote receiver devices, processing untrusted data structures during session negotiation and streaming. An integer overflow in this component causes a numeric value to wrap around the storage limits of its data type. The wrapped value is then used in subsequent memory operations, breaking assumptions the code makes about buffer sizes or object counts.

Exploitation requires an attacker to first control the renderer process, which is standard in modern Chrome exploit chains. From that position, the attacker interacts with the Chromecast interface across a process boundary, triggering the overflow to corrupt memory in a more privileged process. The end result is arbitrary code execution outside the renderer sandbox.

Root Cause

The defect is an unchecked arithmetic operation in the Chromecast code path, categorized under [CWE-190]. Size or length calculations fail to validate operands before multiplication or addition, producing values that no longer reflect the true data size. Downstream allocations or index computations then use the corrupted value, leading to memory corruption exploitable for sandbox escape.

Attack Vector

The attack chain begins with a crafted HTML page that first exploits a separate vulnerability to compromise the renderer. User interaction is required to load the malicious page. Once the renderer is under attacker control, it issues crafted requests to the Chromecast component to trigger the integer overflow and pivot into a higher-privileged process. Additional details are available in the Chromium Issue #517519352.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79292

Indicators of Compromise

Chrome renderer or utility processes spawning unexpected child processes such as command shells or scripting hosts
Unusual outbound connections from Chrome browser processes following visits to untrusted sites
Crash reports referencing the Chromecast or media router components with heap corruption signatures

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running builds earlier than 152.0.7977.65
Alert on Chrome child processes writing to persistence locations such as startup folders, run keys, or scheduled tasks
Correlate browser process crashes with subsequent process creation events indicating a sandbox escape

Monitoring Recommendations

Ingest endpoint process telemetry into a SIEM or data lake to reconstruct browser-initiated attack chains
Monitor Chrome auto-update health and surface endpoints stalled on outdated builds
Track network connections from Chrome to Chromecast discovery ports on non-trusted network segments

How to Mitigate CVE-2026-79292

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed endpoints through the Stable channel
Restart browser sessions after the update so the patched binaries load into memory
Verify enterprise policy configurations do not delay Chrome auto-updates beyond acceptable windows

Patch Information

Google released the fix in the Chrome Stable channel update covered by the Google Chrome Stable Update advisory. Administrators should validate that endpoints report a version of 152.0.7977.65 or higher and confirm managed browser deployments have received the corresponding update.

Workarounds

Disable Chromecast and media routing features via enterprise policy where casting is not required
Restrict outbound access to Chromecast discovery and control ports at the network perimeter
Enforce site isolation and strict HTTPS policies to reduce the likelihood of renderer compromise preceding this exploit stage

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on Linux
google-chrome --version

# Disable Chromecast media routing via enterprise policy (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v EnableMediaRouter /t REG_DWORD /d 0 /f