Google Chrome: Use after free in Chromecast component allows code execution
Summary
Google Chrome versions before 155.0.8059.39 (Linux) and before 155.0.8059.39/.40 (Windows, macOS) contain a critical use-after-free flaw in the Chromecast component (CVE-2026-106382, CVSS 9.6). A remote attacker can execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The attack requires no authentication, but the victim must open the page, so drive-by links and malicious advertisements are the main risk.
Affected
- Google Chrome prior to 155.0.8059.39 (Linux)
- Google Chrome prior to 155.0.8059.39/.40 (Windows, macOS)
- Chromium-based builds that include the affected component, for example Microsoft Edge prior to 155.0.4283.62 (per HKCERT)
Fixed in
- Google Chrome 155.0.8059.39 (Linux) and 155.0.8059.39/.40 (Windows, macOS)
- Newer Chrome 155 point releases also contain the fix; use the latest stable build
- Microsoft Edge 155.0.4283.62 or later
- Debian: 155.0.8059.39-1~deb12u1
Workaround
- No vendor workaround known. Updating is the fix.
- Unknown whether disabling Cast features reduces exposure.
Exploitation
- Google reports no active exploitation.
- CISA ADP Vulnrichment does not mark the CVE as known exploited. The CISA KEV catalogue was not checked directly.
- No public proof of concept found. This does not prove that none exists.
Our recommendation
- Update Google Chrome, Microsoft Edge and any other Chromium-based browsers on all endpoints to the latest stable build.
- Check that automatic updates work and verify the installed version on each workstation.
- Include the other critical Chrome 155 fixes in the same update check.
- Warn users about opening unknown links and advertisements until all systems are patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- HKCERT: Google Chrome multiple vulnerabilities www.hkcert.org
- HKCERT: Microsoft Edge multiple vulnerabilities www.hkcert.org
- OSV: Debian CVE-2026-106382 osv.dev
- Chromegeek: Chrome 155 stable security update www.chromegeek.com
- SecurityWeek: Chrome 155 update patches 247 vulnerabilities www.securityweek.com
- HOL Guard: CISA ADP Vulnrichment record hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:12.
Original description (NVD)
Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.