🚨High - Google Chrome Cast Use-After-Free / Local Network RCE (CVE-2026-10890) A use-after-free vulnerability in Chrome's Cast component allows an attacker positioned on the same local network segment to trigger heap corruption by sending malicious network traffic. The Cast component handles device discovery and media routing to Chromecast and compatible streaming devices over local networks using protocols like mDNS and DIAL, and runs with elevated privileges inside the browser sandbox - making it an attractive target for lateral movement. No authentication or user interaction is required. Attack vector is adjacent network (AV:A), meaning exploitation is limited to attackers already on the local network rather than remote internet-based attackers. 👉Upgrade to Chrome 149.0.7827.53.
Post summary
Google has disclosed a local‑network Remote Code Execution vulnerability via a use‑after‑free in Chrome Cast; updating to Chrome 149.0.7827.53 mitigates the issue.
