Use after free in Chromecast in Google Chrome prior to 149

CVE-2026-10884 is a use-after-free in Chrome's Chromecast component affecting Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and Mac. The key clause is the one most dashboards bury: exploitation assumes the attacker has already compromised the renderer process and can then drive a crafted HTML page into the vulnerable path. In plain English, this is not the initial foothold; it's a follow-on browser-chain bug.

The user-supplied vendor baseline of HIGH 8.3 overstates the enterprise patch urgency for standalone prioritization. Yes, memory corruption in a browser-side component matters, but the prerequisite of renderer compromise first is major friction, and there is no KEV listing, no public PoC, and no confirmed in-the-wild exploitation in the sources reviewed. For a fleet owner, this lands as a meaningful chain hardener rather than a drop-everything internet-edge emergency.

Why this verdict

• Major downward pressure: requires prior renderer compromise. This is already post-initial-exploitation, which means the attacker has to win a separate browser bug first.
• Further downward pressure: no KEV, no public PoC, no active exploitation evidence. That keeps this out of the emergency browser patch bucket.
• Still not low: Chrome is everywhere and sandbox-boundary bugs matter. If paired with a renderer exploit, this can materially improve attacker outcomes on a large employee fleet.

Why not higher?

If this were a one-bug remote compromise from a crafted page, or if Google/CISA were signaling in-the-wild abuse, this would sit much higher. Instead, the exploit chain starts with a different vulnerability, and the restricted bug details plus lack of public weaponization materially reduce present-day operational risk.

Why not lower?

A use-after-free in a ubiquitous browser component is never pure backlog fluff. Once an attacker has renderer control, second-stage browser bugs that can extend impact are exactly the kind of chain pieces high-end operators prize, so dismissing it as LOW would understate the blast-radius potential.

1. Force browser auto-update — Verify enterprise policy is actually enforcing Chrome updates and relaunch prompts across the fleet. For a MEDIUM finding there is no mitigation SLA — use this as hardening while you work inside the 365-day remediation window.
2. Disable Cast features where unused — If your user base does not need browser casting, disable Cast/Chromecast-related functionality through managed browser policy on high-risk groups first. This reduces reachable attack surface without waiting for perfect patch coverage; for MEDIUM, there is no mitigation SLA, so deploy as practical before the remediation deadline.
3. Protect the front half of the chain — Keep Safe Browsing, site isolation, sandboxing, exploit protection, and modern EDR browser monitoring enabled, because the real friction here is stopping the renderer compromise that must come first. This is the control layer most likely to break the chain before CVE-2026-10884 ever matters.
4. Watch for browser crash clusters — Centralize crash telemetry for Chrome processes and look for version-specific spikes after suspicious browsing activity. That will not confirm exploitation on its own, but it is one of the few practical fleet-wide signals for failed memory-corruption attempts.

Run this on the target endpoint or through your software-inventory agent. Invoke it as python3 check_chrome_149_cast_uaf.py with standard user rights; admin is not required. It checks common install locations for Chrome/Chromium on Windows, macOS, and Linux and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_149_cast_uaf.py
# Detects whether locally installed Google Chrome / Chromium is below the fixed version
# for CVE-2026-10884.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIX_LINUX = (149, 0, 7827, 53)
FIX_MAC = (149, 0, 7827, 54)
FIX_WINDOWS = (149, 0, 7827, 54)


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def find_linux():
    candidates = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    for c in candidates:
        path = shutil.which(c)
        if path:
            out = run_cmd([path, '--version'])
            ver = parse_ver(out)
            if ver:
                return c, path, ver
    return None, None, None


def find_mac():
    apps = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ]
    for app in apps:
        if Path(app).exists():
            out = run_cmd([app, '--version'])
            ver = parse_ver(out)
            if ver:
                return Path(app).name, app, ver
    return None, None, None


def find_windows():
    local = os.environ.get('LOCALAPPDATA', '')
    pf = os.environ.get('PROGRAMFILES', '')
    pfx86 = os.environ.get('PROGRAMFILES(X86)', '')
    candidates = [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(local, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Chromium', 'Application', 'chrome.exe'),
    ]
    for exe in candidates:
        if exe and Path(exe).exists():
            out = run_cmd([exe, '--version'])
            ver = parse_ver(out)
            if ver:
                return Path(exe).name, exe, ver
    return None, None, None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def main():
    system = platform.system()
    name = path = None
    ver = None
    fixed = None

    if system == 'Linux':
        name, path, ver = find_linux()
        fixed = FIX_LINUX
    elif system == 'Darwin':
        name, path, ver = find_mac()
        fixed = FIX_MAC
    elif system == 'Windows':
        name, path, ver = find_windows()
        fixed = FIX_WINDOWS
    else:
        print('UNKNOWN - unsupported operating system: {}'.format(system))
        sys.exit(2)

    if not ver:
        print('UNKNOWN - Chrome/Chromium not found in common locations')
        sys.exit(2)

    status = 'PATCHED' if cmp_ver(ver, fixed) >= 0 else 'VULNERABLE'
    print('{} - product={} path="{}" version={} fixed_threshold={}'.format(
        status,
        name,
        path,
        '.'.join(map(str, ver)),
        '.'.join(map(str, fixed))
    ))

    if status == 'PATCHED':
        sys.exit(0)
    else:
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 503617302
3. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Rapid7 historical analog - CVE-2023-5473 Cast use-after-free