CVE-2026-12014: Chrome Use-After-Free in Cast Enables Local Sandbox Escape

Technical summary

CVE-2026-12014 is a use-after-free vulnerability (CWE-416) in Chrome's Cast implementation. The flaw allows an attacker on the adjacent network segment to send malicious traffic that triggers unsafe memory access in the Cast subsystem. Because Cast operates with elevated privileges relative to the renderer process, successful exploitation can lead to sandbox escape—permitting arbitrary code execution in the context of the Chrome process. The attack requires high complexity conditions and does not require user interaction, but the local network adjacency requirement significantly constrains the attack surface compared to fully remote exploits.

Business impact

A sandbox escape in Chrome exposes Windows, macOS, and Linux endpoints to privilege escalation and persistent code execution. In corporate environments, this could allow lateral movement from a compromised workstation or rogue device on the corporate network to break out of browser isolation and access system-level resources. Organizations relying on Chrome as a security boundary (e.g., for untrusted content browsing) lose that protection. The impact is heightened in environments with poor network segmentation or where guest/contractor devices have network access.

Affected systems

Google Chrome versions prior to 149.0.7827.115 on Windows, macOS, and Linux are affected. The vulnerability affects the browser application directly; the underlying OS vendors (Microsoft, Apple, Linux distributions) are listed in the CVE record as affected vendors because Chrome runs on these platforms, but the vulnerability is a Chrome issue, not an OS kernel or OS library flaw. Any organization running Chrome on these operating systems should assume exposure unless patched to version 149.0.7827.115 or later.

Exploitability

The CVSS score of 8.3 (High) reflects the severity of sandbox escape, but exploitability is moderated by several factors. The attacker must be on the same local network segment (not across the internet), and the attack requires high complexity conditions to trigger—meaning the vulnerability is not trivial to weaponize reliably. No public exploit code or proof-of-concept is widely available, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the published date. However, the local-network adjacency requirement is common in internal corporate networks, guest WiFi scenarios, and datacenter environments, so the practical risk should not be underestimated.

Remediation

Update Google Chrome to version 149.0.7827.115 or later on all affected endpoints. Chrome auto-updates are typically enabled by default; verify completion via Chrome's About page (chrome://about). Organizations managing Chrome through enterprise policies (Chrome Browser Cloud Management, Intune, etc.) should deploy the patched version through their MDM/EMM channels and verify rollout completion. For systems unable to update immediately, disable Cast functionality via Chrome policies (cast_receiver_enabled = false) and restrict network access to Cast-enabled devices from untrusted network segments.

Patch guidance

Google has issued Chrome version 149.0.7827.115 as the remediation. Apply patches across all managed Chrome instances as high priority. If your organization uses Chrome Enterprise, verify the availability of version 149.0.7827.115 through your enterprise update channel and deploy via group policy or MDM. Monitor Chrome update status via the Enterprise console. For home and unmanaged users, enable automatic updates and confirm installation by checking chrome://settings/help. Verify the patched version is running on all critical systems before closing remediation tickets.

Detection guidance

Monitor network traffic for unusual patterns on local network segments targeting Chrome instances or Cast-enabled devices. Cast uses mDNS (multicast DNS) and SSDP (Simple Service Discovery Protocol) for discovery; anomalous traffic on these protocols from untrusted sources may indicate exploitation attempts. Additionally, monitor Chrome process memory for signs of memory corruption or crashes in the Cast subsystem—use operating system-level tools (Windows Event Viewer, syslog, audit logs) to flag unexpected Chrome process terminations. EDR solutions can flag attempts to access memory or escalate privileges from the Chrome process context. Host-based intrusion detection rules targeting CWE-416 exploitation patterns may help identify active attacks.

Why prioritize this

Although not yet exploited in the wild (KEV status: false), the sandbox escape nature of this vulnerability and its presence in ubiquitous software (Chrome) warrant high prioritization. The local network requirement limits the blast radius, making this suitable for high-priority but not critical-level response timelines. Prioritize based on: (1) whether the organization permits guest/contractor network access, (2) network segmentation maturity, and (3) the criticality of endpoints running Chrome. Organizations with strict network controls and air-gapped sensitive systems may defer slightly; those with flat networks or shared WiFi should treat as urgent.

Risk score, explained

The CVSS 8.3 score reflects: Attack Vector (Adjacent Network) = local but still significant, Attack Complexity (High) = not trivial to trigger, Privilege Requirement (None) = attacker needs no pre-existing privilege, User Interaction (None) = no user action required, Scope (Changed) = the impact extends beyond the vulnerable component (the sandbox), and Confidentiality/Integrity/Availability (all High) = the attacker gains near-total control. The high complexity rating prevents a critical (9.0+) score, but sandbox escape in a widely-used browser reliably justifies the high severity band. Organizations should treat this as a significant but manageable risk if patched promptly.

Frequently asked questions