CVE-2026-10884: Use after free in Chromecast in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Chromecast component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network but requires the victim to visit or interact with a malicious page, and it carries high impact across confidentiality, integrity, and availability due to the scope change enabled by the sandbox escape. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, delivering a crafted HTML page that the victim's browser loads.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched from an unauthenticated web page.

• Victim interactionRequired

  The victim must visit or otherwise interact with the attacker-controlled HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must have already compromised the renderer process before the use-after-free can be used for a sandbox escape, introducing a significant prerequisite step.

Blast Radius

• A successful sandbox escape gives the attacker code execution outside the Chrome renderer sandbox, at a privilege level beyond the browser process itself.
• With high confidentiality impact, the attacker can read data accessible to the browser process, including stored credentials, cookies, and session tokens.
• With high integrity impact, the attacker can write or modify files and data reachable by the escaped process, including user profile data and locally cached content.
• With high availability impact, the attacker can crash or hang the affected service or host process, disrupting the user session and any dependent workloads.