Description
Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-10-06
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Use after free in the Chromecast component of Google Chrome prior to 155.0.8059.39 enables an attacker to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. This flaw can lead to full system compromise and is rated critical by the Chromium security team.

Affected Systems

Google Chrome versions earlier than 155.0.8059.39 on all platforms that support Chromecast are affected. The vulnerability is located in the Chromecast component within Chrome.

Risk and Exploitability

The attack requires a victim to load a malicious HTML page that triggers the use‑after‑free in the Chromecast component. Because the flaw allows code execution outside the sandbox, it represents a high‑impact remote code execution vector. With a CVSS score of 9.6, the vulnerability is rated critical. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, but its ability to be triggered through a simple crafted page makes it a significant risk for users who have not upgraded.

Generated by OpenCVE AI on October 7, 2026 at 03:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 155.0.8059.39 or later.
  • If upgrading is not possible or delayed, disable the Chromecast feature through enterprise policy or remove Chromecast functionality to prevent the vulnerable code from executing.
  • Monitor browser activity for attempts to load suspicious content and review logs for signs of exploitation, treating any detected incidents as high‑severity events.

Generated by OpenCVE AI on October 7, 2026 at 03:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Use After Free in Chromecast Enables Remote Code Execution Outside the Sandbox chromium-browser: Use after free in Chromecast
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Use After Free in Chromecast Enables Remote Code Execution Outside the Sandbox

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:55:36.389Z

Reserved: 2026-10-06T16:37:11.053Z

Link: CVE-2026-106382

cve-icon Vulnrichment

Updated: 2026-10-06T19:26:47.421Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:07.400

Modified: 2026-10-07T13:45:17.947

Link: CVE-2026-106382

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:05Z

Links: CVE-2026-106382 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:45:12Z

Weaknesses