CVE-2026-79054

No known exploitation. EPSS puts it in the 32nd percentile. A vendor fix is available.

CVSS 3.18.3High EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-25Updated 2026-08-27Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Google Chrome and whether it’s older than 152.0.7977.65.
If it is older, update Google Chrome to 152.0.7977.65 or later.
If you can’t update right away, disable or restrict Chromecast-related functionality in Chrome (as allowed by your IT policy) until you can update.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

In plain language

Written by AI from the record

Google Chrome versions before 152.0.7977.65 can let an attacker run code on your computer if they have already taken over Chrome’s renderer process, via a crafted web page that abuses Chromecast—most small businesses won’t face this unless an attacker is already inside.

Use-after-free in the Chromecast component of Google Chrome prior to 152.0.7977.65 can be triggered by a specially crafted HTML page after an attacker compromises the renderer process, enabling arbitrary code execution outside the browser sandbox.

If you're affected

Full system compromise
Malware execution
Data theft risk
Ransomware risk

What is it

This is a programming mistake (a “use after free”) in how Chrome handles Chromecast content. If someone can already take control of part of Chrome (the renderer), they can use a specially crafted page to break out of the browser’s safety walls and run code on your device. Think of it like escaping from a locked room using a flaw in the door hinges—only possible if they already have access to the room.

Who is affected

This affects you if you use Google Chrome with Chromecast enabled, and your Chrome is prior to 152.0.7977.65. The risk is not just “visit a bad website”—it requires that a remote attacker has already compromised the Chrome renderer process. It becomes a real concern only in scenarios where an attacker already has a foothold inside Chrome, such as through a prior compromise.

How urgent is it

This should be treated as a serious patch because it can enable code execution outside the browser sandbox once the renderer process is compromised. Even though there’s no confirmed KEV listing or public exploit code in the provided information, the weakness is directly capable of full compromise and should be fixed now rather than later.

What to do — in detail

Confirm exposure

On each affected workstation/server, open Google Chrome and check the installed version.
Verify whether the version is prior to 152.0.7977.65.

Update to the fixed version

Upgrade Google Chrome to 152.0.7977.65.
If you manage Chrome centrally, use your normal enterprise update mechanism to roll out the upgrade to all endpoints where Chrome is installed.

Interim mitigation (if patching is delayed)

If you cannot update immediately, reduce exposure by disabling or restricting Chromecast-related functionality in Chrome according to your IT policy (so the Chromecast component is not used).
Also ensure Chrome is not broadly accessible on higher-risk machines until patched.

Validation after the update

Re-check the Chrome version number and confirm it is now 152.0.7977.65 or later.
If your environment logs browser activity, look for unusual Chromecast-related activity around the time of any browsing sessions.

What to monitor

Monitor endpoints for signs of browser-related post-compromise activity (unexpected processes launched from browser context, new persistence mechanisms, or suspicious outbound connections), since this issue is most dangerous after renderer compromise.

KEV due date

KEV: not listed in CISA KEV in the provided findings, so no CISA due date is available from the supplied data.

Technical context

Severity/impact: High (use-after-free, CWE-416) with capability to execute arbitrary code outside the browser sandbox. Attack vector: Network via a specially crafted HTML page, but exploitation requires renderer compromise (precondition). Affected component/feature: Chromecast within Google Chrome. Authentication: none required. User interaction: required.

Exploit/exposure status: No KEV listing in the provided findings; no public exploit code on record in the provided findings; no clear dated real-world exploitation claim in the provided excerpt. Press attention is rising in a roundup context, but that is not the same as confirmed exploitation.

EPSS (private note for teams): Provided as 0.4% with a flat trend; not used to override exploitation status since there is no KEV/news confirmation in the supplied findings.

Fix: Google Chrome fixed in 152.0.7977.65. Use-after-free (CWE-416) means the code references memory that has already been freed; under the right heap/timing conditions, this can be leveraged after renderer compromise to gain escape from sandbox boundaries.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 4 days, from the signal feeds we watch.

2026-08-29OpenVAS check added
2026-08-27Patch availablerecord updated
2026-08-26Patch availablerecord updated, record updated, record updated
2026-08-25Publishedweakness classified, att&ck mapped, record updated

Affected products

Googlecommercial · USaka google inc, google llc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Scored 8.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable