External risk intelligence

Chromecast Use After Free Vulnerability in Google Chrome

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-106382

The vulnerability exists within the Chromecast component of the Google Chrome web browser. This is a client-side end-user application. While it processes remote content, it is not a server, edge gateway, or internet-facing service that is deployed to be reached by the public internet in the manner described by the rubric.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Google Chrome's Chromecast component that could allow an attacker to execute code outside the sandbox. This type of issue, while concerning, has been classified as having a very low likelihood of impacting our environment because it affects client-side applications and not internet-facing services.

Code execution flaw in browser component.
Low impact for leadership due to client-side focus.
Confirm relevance; no immediate executive action.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then targets a weakness in the browser's code handling. This could allow them to run their own code on the user's device, escaping security boundaries.

No privileges or user interaction required.
Malicious webpage triggers code execution.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Chromecast component of Google Chrome could allow a remote attacker to execute arbitrary code outside the browser's sandbox when a user visits a specially crafted HTML page. This could potentially affect system data and user data processed by the browser, depending on the specific conditions and configurations.

System data and user data.
Via a crafted HTML page.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chromium security team is likely responsible for this vulnerability, which affects Google Chrome's Chromecast component. The initial step should be to identify all instances of the affected browser, assess their exposure and business criticality, and then coordinate with Google for updates or patches.

Chromium security team owns the fix.
Verify browser deployment and exposure.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Chromecast component in Google Chrome?

Chromecast in Google Chrome is a built-in feature set that handles media casting, allowing users to send content from their browser to external devices like TVs or displays. It operates as an integrated module within the browser architecture, processing incoming streams and web content to facilitate these interactions seamlessly.

What does a use-after-free vulnerability mean in CVE-2026-106382?

This vulnerability is classified as CWE-416, which occurs when a program continues to use a memory address after that memory has been cleared or released. In this case, it allows an attacker to manipulate that freed memory space to inject and execute their own unauthorized code on the host system.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by hosting a specially crafted HTML page. When a user navigates to this malicious site, the browser's Chromecast component improperly processes the code, leading to the memory error. It does not trigger simply by having the browser open; the user must actively visit the specific, malicious webpage.

Is my organization at risk from this Google Chrome CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to pose a high risk to organizational infrastructure. Because it exists in a client-side browser application rather than a server-based internet-facing service, it requires individual user interaction to succeed, making it less dangerous than server-side vulnerabilities.

What should I do if I use Google Chrome?

Your first step is to confirm which versions of Google Chrome are currently deployed across your systems. Since the fix is managed by the Chromium team, you should plan to update your browser software to version 155.0.8059.39 or later during your next routine maintenance window to ensure the vulnerability is patched.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.