CVE-2026-78939
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Use after free in the Chromecast component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a high severity rating.
Risk Assessment
An attacker could execute malicious code outside the sandbox, potentially leading to full compromise of the user's system.
Recommendation
Update Google Chrome to version 152.0.7977.65 or later to fix this vulnerability.
Original NVD description (English source)
Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)