CVE-2026-106382

Executive Summary

CVE-2026-106382 is a use-after-free (UAF) vulnerability in the Chromecast component of Google Chrome prior to version 155.0.8059.39, rated Critical by the Chromium security team with a CVSS v3.1 base score of 9.6. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to visit a crafted HTML page, exploiting the memory-corruption condition to execute arbitrary code at a privilege level outside the browser sandbox. All users running unpatched Chrome builds that include the affected Chromecast code path are at risk, though successful exploitation requires user interaction (page visit) and no public proof-of-concept or in-the-wild exploitation has been confirmed as of this writing.

Technical Analysis

The vulnerability is classified as CWE-416: Use After Free. A use-after-free defect arises when a program continues to reference a heap-allocated object after that object's memory has been freed. In the context of a browser engine, this class of bug is particularly severe because freed heap memory can be re-allocated and populated with attacker-controlled data, allowing an attacker to hijack a dangling pointer and redirect program execution.

The NVD description attributes the flaw to the Chromecast subsystem of Google Chrome. Chromecast functionality in Chrome handles media casting interactions, discovery of cast receivers, and related message/object lifecycle management. A UAF in this subsystem implies that an object associated with a casting operation is released while a reference to it is still held — for example, during asynchronous handling of a crafted page that manipulates casting-related activity. When the stale pointer is subsequently dereferenced, the attacker can influence the contents of the reclaimed memory.

The criticality of this flaw is amplified by the CVSS scope change (S:C) and the stated impact that code execution occurs outside the sandbox. Chrome's renderer is normally isolated in a sandbox; a UAF that leads to code execution outside that sandbox indicates the corruption affects a more privileged process context rather than remaining contained in a compromised renderer. This elevates the severity from a typical renderer-only bug to a full arbitrary-code-execution primitive at the browser or browser-adjacent privilege level.

Attack surface: the flaw is reachable via network-delivered HTML (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and requires user interaction (UI:R) in the form of loading a crafted page. The Chromium security severity is Critical.

No public PoC, exploit code, or Nuclei template is available, and the description does not disclose specific function names, class names, or file paths. Accordingly, the following analysis remains at the vulnerability-class level rather than asserting implementation specifics that are not present in the source data.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (CWE-416 use-after-free) and the NVD description. Specific internal symbol names are not provided in the source data and are therefore not asserted.

1. Reconnaissance / Target Identification. The attacker identifies victims running an unpatched Google Chrome build below 155.0.8059.39. This can be done by serving a page that fingerprints the browser user-agent and version, or by broadly targeting Chrome users via a compromised or attacker-controlled website, malvertising, or a phishing lure. Chromecast-related functionality is present in the browser regardless of whether a physical cast device is on the network, so no special victim environment is strictly required.

2. Triggering the Flaw Class. The victim is induced to visit a crafted HTML page. The page contains content engineered to drive the Chromecast subsystem into a state where an object is freed while a dangling reference remains. Because the precise trigger is not disclosed, the exact page structure is unknown; at the vulnerability-class level, the crafted page manipulates the lifecycle of a Chromecast-associated object to produce the use-after-free condition.

3. Payload / Execution. After the object is freed, the attacker arranges for the freed memory region to be re-allocated and populated with controlled data. The dangling pointer is then dereferenced, giving the attacker control over execution flow. Per the NVD description, this results in execution of arbitrary code outside the sandbox, meaning the primitive escapes the normal renderer containment rather than being limited to a sandboxed process.

4. Post-Exploitation Impact. Successful exploitation yields arbitrary code execution at the privilege level described (outside the sandbox), enabling the attacker to read/modify data (C:H/I:H), disrupt availability (A:H), and potentially establish persistence or move laterally within the victim host context. The scope change (S:C) indicates impact extends beyond the vulnerable component's original security scope.

Because no exploit code exists publicly, defenders should treat this as a high-severity memory-corruption threat that is plausible to weaponize but not yet observed in the wild.

Impact Assessment

With a CVSS v3.1 base score of 9.6 (Critical), this vulnerability represents a near-maximum severity issue. Breaking down the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H:

• Attack Vector (N): Exploitable remotely over the network via a crafted HTML page.
• Attack Complexity (L): No specialized conditions or race-window precision are indicated as prerequisites.
• Privileges Required (N): The attacker needs no authentication.
• User Interaction (R): The victim must visit the crafted page.
• Scope (C): A successful exploit impacts resources beyond the vulnerable component (sandbox escape).
• Confidentiality / Integrity / Availability (H/H/H): All three are rated High, indicating full loss of data confidentiality, integrity, and availability in the impacted context.

Business impact: Any organization whose workforce or customers use unpatched Chrome is exposed. The sandbox-escape characteristic means compromise is not contained to a single tab's renderer — it can reach data and resources the browser process can access, including saved credentials, session tokens, and host filesystem interactions available to the browser. Blast radius spans every affected endpoint: desktops, laptops, and any environment where Chrome is deployed but not centrally patched. Because exploitation is browser-mediated and requires only a page visit, the effective attack surface is the entire internet-facing browsing population.

Detection Guidance

Sigma Rule

title: Potential Chrome Chromecast Use-After-Free Exploitation (CVE-2026-106382)
id: 8f2c1a44-3b7e-4d9a-9c21-106382000001
status: experimental
description: Detects Chrome process crashes or abnormal termination consistent with memory-corruption exploitation attempts against the Chromecast component.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106382
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
  selection_crash:
    CommandLine|contains:
      - '--type=renderer'
      - '--type=utility'
  selection_fault:
    EventID: 1000
  condition: selection_img or (selection_crash and selection_fault)
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate browser crashes
  - Browser updates and plugin failures
level: medium
tags:
  - attack.t1189
  - cve.2026.106382

YARA Rule

rule CVE_2026_106382_Chrome_Chromecast_UAF
{
    meta:
        description = "Heuristic detection for crafted HTML pages targeting the Chrome Chromecast use-after-free (CVE-2026-106382)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106382"
        severity = "critical"

    strings:
        $cast1 = "cast" ascii nocase
        $cast2 = "chromecast" ascii nocase
        $cast3 = "presentation" ascii nocase
        $js1   = "document.createElement" ascii
        $js2   = "requestAnimationFrame" ascii

    condition:
        (2 of ($cast*)) and (1 of ($js*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106382 Possible Chrome Chromecast UAF Exploitation Attempt"; flow:established,to_server; content:"User-Agent|3a 20|"; http_header; content:"Chrome/"; http_header; pcre:"/Chrome\/(1[0-4][0-9]|15[0-4])\./H"; classtype:attempted-user; sid:1063820; rev:1; reference:cve,2026-106382; metadata:service http;)

Elastic Detection

process where process.name == "chrome.exe" and
  (process.command_line like~ "*--type=renderer*" or process.command_line like~ "*--type=utility*") and
  event.action == "process-crashed"

Splunk SPL Query

index=endpoint OR index=windows
(Image="*\\chrome.exe" OR process_name="chrome.exe")
(CommandLine="*--type=renderer*" OR CommandLine="*--type=utility*")
| stats count by host, user, Image, CommandLine
| where count > 3

Wazuh OSSEC Rule

<group name="chrome,cve-2026-106382,">
  <rule id="106382" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">chrome.exe</field>
    <field name="win.eventdata.commandLine">--type=renderer</field>
    <description>CVE-2026-106382: Possible Chrome Chromecast use-after-free exploitation (renderer crash)</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_106382,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the CNA title references Chrome 155.0.8059.39 as the fixing version, but no patch artifact, vendor advisory body, or package fix has been confirmed by tracked sources. Treat the environment as unpatched until verified.

1. Immediate mitigations:

   • Update Google Chrome to version 155.0.8059.39 or later as soon as it is available/verifiable through official Google release channels; verify the installed version via chrome://version.
   • Where the fixed version cannot yet be confirmed, reduce exposure: enforce strict browsing policies, disable or restrict unnecessary casting/Chromecast functionality via enterprise policy if feasible, and block untrusted HTML delivery where practical.
   • Isolate high-risk browsing through virtualization or dedicated low-privilege environments.
   • Enable browser crash reporting and monitor for abnormal renderer/utility process termination that may indicate exploitation attempts.

2. Patch / upgrade steps:

   • Centrally manage Chrome updates through your endpoint management or MDM solution; confirm deployment of build 155.0.8059.39+.
   • Verify patch status across all platforms (Windows, macOS, Linux) since browser builds are versioned separately per platform.
   • Re-audit again once Google publishes a formal stable-channel release note confirming the fix.

3. Long-term hardening:

   • Maintain an aggressive browser update cadence with automatic updates enabled and enforced.
   • Deploy exploit-mitigation features (site isolation, strict sandboxing) and keep them enabled.
   • Adopt a vulnerability management program that prioritizes browser memory-corruption bugs with sandbox-escape characteristics.
   • Consider network-layer filtering and DNS controls to reduce exposure to malicious or compromised sites.

References

• NVD — CVE-2026-106382: https://nvd.nist.gov/vuln/detail/CVE-2026-106382
• Google Chrome Release Notes (Stable Channel): https://chromereleases.googleblog.com/
• Chromium Security Severity Guidelines: https://www.chromium.org/developers/severity-guidelines/
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html

Exploit-in-the-wild status: No known threat actor campaigns or confirmed in-the-wild exploitation have been reported. CISA KEV status: NOT listed. No public PoC or exploit code is available as of this report; continued monitoring is advised given the Critical severity and sandbox-escape impact.