CVE Intelligence
Analysis AI-assisted

CVE-2026-106382: Google Chrome Chromecast Use-After-Free Vulnerability

A use-after-free flaw in the Chromecast component of Google Chrome before 155.0.8059.39 may allow a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. The record rates it critical, with a CVSS score of 9.6 from the CNA and CISA-ADP. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106382 is a use-after-free memory safety issue in the Chromecast component of Google Chrome. According to the record description, the flaw can be triggered by a crafted HTML page and may allow code execution outside the browser sandbox. The Chromium security severity is listed as Critical.

Impact

  • The description states that a remote attacker could execute arbitrary code outside the sandbox.
  • The record assigns CVSS 9.6 from the CNA and CISA-ADP, with high confidentiality, integrity and availability impact and user interaction required.
  • The CWE classification is CWE-416 (Use After Free).
  • Impact on a specific environment depends on Chrome version, configuration and user context, which the record does not describe.

Affected products and versions

  • Product: Google Chrome.
  • The description says the flaw affects versions prior to 155.0.8059.39.
  • The affected entries in the record are inconsistent: one lists versions below 155.0.8059.39 and another lists a range that is empty as written. Treat the description as the authoritative statement and verify against the Chrome release notes.

Exploitation status

The CISA KEV catalog does not list this CVE, and the SSVC data in the record marks exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome on desktop systems to version 155.0.8059.39 or later, as indicated by the record description and the vendor release notes.
  • Confirm the deployed build across managed endpoints, including systems where automatic updates are disabled or delayed.
  • Until updates are applied, limit exposure to untrusted web content and keep browser policies and extensions under review.

Detection guidance

  • Inventory Chrome versions across the environment and flag any build older than the fixed version named in the description.
  • Review endpoint telemetry for unexpected browser crashes or anomalous child processes spawned by the browser, as general signs of memory corruption attempts.
  • Track vendor advisories for updates to the record.

Limitations of the available information

  • The record title is missing and has been written from the description.
  • The fixes list is empty; the fixed version is taken from the description wording 'prior to 155.0.8059.39'.
  • No proof-of-concept details, public exploit references or independent technical analysis are present in the record.
  • The EPSS probability is low at the time of the record, but this does not change the critical vendor severity.

Frequently asked questions

What is CVE-2026-106382?

It is a use-after-free vulnerability in the Chromecast component of Google Chrome that the record says may allow arbitrary code execution outside the sandbox via a crafted HTML page.

Which versions are affected?

The description says Chrome versions prior to 155.0.8059.39 are affected. The affected entries in the record are inconsistent, so verify against the vendor release notes.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list it and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Google Chrome to 155.0.8059.39 or later, confirm the deployed versions across endpoints, and limit exposure to untrusted web content until patches are applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.