diff --git a/components/cast_streaming/browser/cast_streaming_session.cc b/components/cast_streaming/browser/cast_streaming_session.cc index 59224cb0d55ad..09f6a35b4fb0b 100644 --- a/components/cast_streaming/browser/cast_streaming_session.cc +++ b/components/cast_streaming/browser/cast_streaming_session.cc @@ -417,6 +417,11 @@ void CastStreamingSession::ReceiverSessionClient::OnReceiversDestroying( playback_command_dispatcher_->OnRemotingSessionEnded(); } + // Any deferred StartStreamingSession() callback binds raw_ptr to + // the receivers that are about to be freed; drop it to avoid a UAF when the + // pending Flush() completes. + start_session_cb_.Reset(); + preloaded_audio_buffer_ = std::nullopt; preloaded_video_buffer_ = std::nullopt;