CVE-2026-95372: Google Chrome Chromecast Use After Free

CVE-2026-95372 Overview

CVE-2026-95372 is a use-after-free vulnerability [CWE-416] in the Chromecast component of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.57 on desktop. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Google's Chromium team rated the security severity as High. The Chrome Stable channel update addressed the issue as part of a scheduled desktop release.

Critical Impact
Successful exploitation enables sandbox escape from the renderer process, giving attackers code execution in a more privileged Chrome process context.

Affected Products

Google Chrome (Desktop) versions prior to 154.0.8037.57
Chromecast component within Chromium-based browsers
Downstream Chromium browsers that have not yet integrated the upstream fix

Discovery Timeline

2026-09-29 - CVE-2026-95372 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95372

Vulnerability Analysis

The vulnerability resides in the Chromecast integration within Google Chrome. Use-after-free defects occur when code continues to reference memory that has already been released back to the allocator. Attackers who can influence allocation and deallocation patterns can reclaim the freed region with controlled data. Subsequent use of the dangling pointer then operates on attacker-controlled memory, leading to code execution.

This specific flaw requires the attacker to first compromise the renderer process. From that foothold, a crafted HTML page interacting with Chromecast can trigger the dangling pointer condition. The result is potential arbitrary code execution outside the renderer sandbox, which represents a sandbox escape.

Root Cause

The root cause is an object lifetime management error [CWE-416] in the Chromecast component. A Chromecast-related object is freed while another code path retains a reference to it. When the retained reference is later dereferenced, the memory may already be reused, allowing an attacker who controls the reclaimed allocation to hijack control flow.

Attack Vector

Exploitation requires a two-stage attack chain. First, the attacker must compromise the Chrome renderer process, typically through a separate renderer bug. Second, the attacker delivers a crafted HTML page that exercises the Chromecast code path to trigger the use-after-free. User interaction is required, and attack complexity is high because a renderer compromise is a prerequisite. The scope changes because code executes outside the sandbox boundary.

No public proof-of-concept is available. Technical specifics are restricted in the Chromium Issue Tracker Entry per Google's standard disclosure practice.

Detection Methods for CVE-2026-95372

Indicators of Compromise

Chrome renderer process crashes referencing Chromecast or media router modules preceding sandbox-adjacent activity.
Unexpected child processes spawned by chrome.exe following visits to untrusted web pages.
Outbound connections to attacker-controlled infrastructure originating from Chrome utility or GPU processes.

Detection Strategies

Inventory Chrome installations across the environment and flag any version below 154.0.8037.57.
Correlate browser crash telemetry with process creation events to surface post-exploitation behavior.
Hunt for HTML content that invokes Presentation API or Cast-related interfaces from low-reputation domains.

Monitoring Recommendations

Enable browser crash reporting and forward Chrome WerFault and crashpad events to the SIEM.
Monitor endpoint EDR telemetry for anomalous process trees rooted in Chrome renderer or utility processes.
Track egress from browser processes to non-standard destinations using network detection tooling.

How to Mitigate CVE-2026-95372

Immediate Actions Required

Update Google Chrome to version 154.0.8037.57 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs to ensure the patched binaries are loaded into memory.
Verify that managed browser fleets have automatic updates enabled and are not pinned to older channels.

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for release notes and the Chromium Issue Tracker Entry for issue metadata. Downstream Chromium-based browsers should ship equivalent updates once they merge the upstream commit.

Workarounds

Disable Chromecast and media casting features through enterprise policy where casting is not required.
Restrict browsing to trusted sites via web filtering to reduce exposure to crafted HTML payloads.
Enforce site isolation and strict sandbox policies to raise the cost of chaining a renderer compromise.

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version