Use-after-free in the Chromecast component of Google Chrome prior to version 154.0.8037.57 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. The flaw is a classic use-after-free bug (CWE-416) that can lead to full system compromise once sandbox escape is achieved.

The vulnerability exists in Google Chrome for all platforms. Versions earlier than 154.0.8037.57 are affected; any installation of Chrome without this patch is at risk.

With a base CVSS score of 8.3 the flaw is considered high severity. No EPSS data are available and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploits are currently known. However, the required condition of a compromised renderer process makes the attack vector less straightforward; a local or network attacker must first achieve renderer compromise, often via an earlier vulnerability or malicious web content, before exploiting the use-after-free. If such a foothold is achieved, arbitrary code execution is possible outside the sandbox.