CVE-2026-15899

Google · Chrome

A critical use-after-free vulnerability in the CameraCapture component of Google Chrome on Mac permits remote attackers to achieve a sandbox escape through a crafted HTML page.

Executive summary

A critical use-after-free vulnerability in Google Chrome on Mac allows remote attackers to bypass the sandbox, posing a severe risk to system integrity.

Vulnerability

This is a memory corruption vulnerability (Use After Free) within the CameraCapture component. An unauthenticated remote attacker can trigger this flaw via a maliciously crafted HTML page to escape the browser sandbox and execute arbitrary code on the host system.

Business impact

With a CVSS score of 9.6, this vulnerability is classified as critical. A successful sandbox escape allows an attacker to transition from browser-based compromise to full system-level access, potentially leading to total data exfiltration or complete control over the user's workstation.

Remediation

Immediate Action: Update Google Chrome to version 150.0.7871.128 or later immediately to address the memory management flaw.

Proactive Monitoring: Ensure endpoint detection systems are updated to identify malicious process behavior originating from the browser environment.

Compensating Controls: Restrict browser capabilities where possible and encourage the use of security-hardened configurations for high-risk users.

Exploitation status

Public Exploit Available: Yes (a public proof-of-concept exists).

Analyst recommendation

Given the critical severity and the capability for sandbox escape, this update is of the highest priority. All users on the affected platform should ensure their browser is patched to 150.0.7871.128 to mitigate the risk of system compromise.