CVE-2026-12014: Use after free in Cast in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Cast component of Google Chrome (versions prior to 149.0.7827.115) allows an attacker on the same local network segment to exploit freed memory and escape the browser sandbox via crafted network traffic. The attack requires no authentication and no victim interaction, but the attacker must share the local network (LAN, Wi-Fi, or VPN segment) with the targeted host. Successful exploitation gives the attacker full read, write, and availability impact outside the browser sandbox, effectively achieving code execution in the context of the host process. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN, Wi-Fi, or VPN) as the target; remote internet-based exploitation is not possible via this vector.

• AuthenticationNot required

  No account or credential is needed; the attacker sends malicious network traffic directly to the vulnerable Cast service.

• Victim interactionNot required

  The exploit is delivered entirely through network traffic and does not require the user to click, open, or interact with anything.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning it likely depends on race conditions, specific memory layout, or other environmental factors that make reliable exploitation non-trivial.

Blast Radius

• The attacker escapes the Chrome browser sandbox and gains code execution in the context of the host OS process.
• Confidential data accessible to the Chrome process, including stored credentials, session tokens, and browsing history, becomes readable to the attacker.
• The attacker can write or modify files and system state accessible to the compromised process, including persistent storage and configuration.
• The attacker can crash or destabilize the affected process and dependent services, causing a denial of service on the host.