CVE-2026-95372 in Chrome
Summary
by MITRE • 09/29/2026
Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a use-after-free condition within Google Chrome prior to version 154.0.8037.57 represents a critical memory management flaw specifically affecting the Chromecast integration components of the browser engine. This defect arises when the application fails to properly invalidate pointers or references after freeing associated memory structures, leading to dangling pointer scenarios where previously allocated memory is accessed post-deallocation. In the context of Chromium-based browsers, such errors are particularly dangerous because they can bypass standard security mitigations if exploited within specific subsystems like Chromecast, which handles media casting and device communication protocols. The root cause typically involves a race condition or logic error in the lifecycle management of objects related to cast sessions, where an object is destroyed while still being referenced by another active component that expects it to remain valid for subsequent operations.
From a technical perspective, this flaw allows for arbitrary code execution outside the browser sandbox when triggered by a remote attacker. The attack vector involves crafting a malicious HTML page or web application that interacts with the Chromecast API in a way that induces the use-after-free condition. Once an attacker compromises the renderer process through initial exploitation of another vulnerability or via social engineering, they can leverage this memory corruption to gain control over program flow. By carefully manipulating heap contents and controlling the data written into the freed memory region, an attacker can achieve arbitrary read-write primitives. These primitives are then chained with other techniques to escape the sandboxed environment, ultimately allowing the execution of native code on the host operating system with the privileges of the current user.
The operational impact of this vulnerability is severe due to its potential for remote code execution and sandbox escape. An attacker who successfully exploits this flaw can install malware, steal sensitive data such as credentials or browsing history, establish persistence mechanisms, or use the compromised machine as a pivot point for further network attacks. The severity rating of High by the Chromium security team reflects the ease with which an experienced attacker could construct a proof-of-concept exploit given access to the renderer process. This is particularly concerning because many modern web applications rely heavily on browser APIs, and if a site can trigger this condition through standard JavaScript interactions or embedded media controls, it significantly lowers the barrier for exploitation compared to vulnerabilities requiring complex binary-level inputs.
Mitigation strategies primarily involve updating Google Chrome to version 154.0.8037.57 or later, where these memory management issues have been addressed by developers through improved pointer invalidation and stricter object lifecycle checks. Organizations should enforce automated patching policies for all endpoints running the affected browser versions to minimize exposure windows. Additionally, security teams can implement application control solutions that restrict the execution of untrusted scripts within renderer processes if possible, although this is often difficult in standard browsing scenarios. Monitoring network traffic for unusual outbound connections from Chrome processes may also help detect active exploitation attempts involving Chromecast-related communications.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free errors resulting from improper memory management practices. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Defense Evasion and Privilege Escalation, specifically sandbox escape mechanisms that allow attackers to move beyond restricted execution environments. The exploitation path typically involves initial access via a crafted web page followed by privilege escalation through sandbox breakout using memory corruption primitives. Understanding these mappings helps security professionals prioritize remediation efforts based on established threat intelligence frameworks and industry best practices for mitigating high-severity browser vulnerabilities.