CVE-2026-78939: Use after free in Google Chrome

This vulnerability involves a use-after-free condition in the Chromecast functionality of Google Chrome versions before 152.0.7977.65. Exploitation requires that the attacker has already compromised the renderer process and can then execute arbitrary code outside the sandbox environment via a specially crafted HTML page. The vulnerability has a high impact on confidentiality, integrity, and availability, as indicated by the CVSS vector. No known exploits in the wild have been reported at the time of publication.

Successful exploitation allows remote code execution outside the sandbox, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability at a high level. There are no reports of active exploitation in the wild.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for detailed update instructions.