CVE-2026-11654: Google Chrome Use After Free Vulnerability

CVE-2026-11654 Overview

CVE-2026-11654 is a use-after-free vulnerability in the CameraCapture component of Google Chrome on macOS. The flaw affects Chrome versions prior to 149.0.7827.103 and allows a remote attacker to potentially perform a sandbox escape using a crafted HTML page. The issue is tracked under [CWE-416] (Use After Free) and is categorized by Chromium as high severity. A sandbox escape in the browser process can give an attacker code execution outside the renderer boundary, broadening access to the underlying macOS host.

Critical Impact
Successful exploitation enables a sandbox escape from a malicious web page, undermining Chrome's primary process isolation boundary on macOS.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Apple macOS (Chrome desktop builds)
Chromium-based deployments shipping the vulnerable CameraCapture component

Discovery Timeline

2026-06-09 - CVE-2026-11654 published to NVD
2026-06-09 - Last updated in NVD database
2026-06 - Google releases stable channel update for desktop addressing the issue

Technical Details for CVE-2026-11654

Vulnerability Analysis

The vulnerability resides in Chrome's CameraCapture implementation, which handles camera input streams exposed through web APIs such as getUserMedia. A use-after-free condition occurs when the code references a heap object after it has been freed, allowing an attacker to influence the contents of the reclaimed memory region.

Because CameraCapture operates with elevated privileges relative to the renderer sandbox, controlling the freed object can lead to a sandbox escape. The attacker delivers a crafted HTML page that drives the camera capture pipeline through a specific sequence of operations, triggering object lifetime mismatches. User interaction is required, consistent with prompting or interacting with media capture flows.

Root Cause

The root cause is improper object lifetime management within the CameraCapture subsystem. A reference to a capture-related object persists after the object is deallocated, and a later code path dereferences that stale pointer. Heap layout manipulation from the renderer can replace the freed allocation with attacker-controlled data, converting the dangling reference into a controlled read or write.

Attack Vector

Exploitation is network-based and initiated from a malicious or compromised web page. The attacker entices the victim to visit the page and interact with prompts that exercise the camera capture path. The renderer process then triggers the flawed sequence in the browser process, and a successful chain results in code execution outside the renderer sandbox on macOS. No verified public proof-of-concept code is currently available for this issue. Refer to the Chromium Issue Report for technical context.

Detection Methods for CVE-2026-11654

Indicators of Compromise

Chrome processes on macOS spawning unexpected child processes or shells following media capture interactions
Outbound connections from Google Chrome Helper processes to untrusted domains immediately after visits to unknown sites
Unusual crashes or restart loops in Chrome processes referencing CameraCapture or media capture modules

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 149.0.7827.103
Hunt for renderer or browser process crashes correlated with media device access events
Monitor for post-exploitation behaviors such as persistence creation, keychain access, or new LaunchAgents originating from Chrome process trees

Monitoring Recommendations

Centralize macOS endpoint telemetry, including process lineage and network connections, into a SIEM or data lake for correlation
Alert on Chrome child processes invoking shells (/bin/bash, /bin/zsh), osascript, or curl shortly after browser activity
Track browser version drift continuously and tie version data to vulnerability exposure dashboards

How to Mitigate CVE-2026-11654

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 149.0.7827.103 or later
Force-restart Chrome after deployment so the updated binary is loaded into memory
Validate patched versions across managed fleets using MDM or endpoint management reporting

Patch Information

Google addressed the issue in the Chrome stable channel update for desktop. Details are documented in the Google Chrome Stable Channel Update. Administrators should ensure Chrome auto-update is enabled and not blocked by enterprise policy or network controls.

Workarounds

Restrict camera access in Chrome site settings until the patch is deployed
Use enterprise policy to block access to untrusted sites that request media permissions
Encourage users to deny getUserMedia prompts on unfamiliar pages until updates are confirmed installed

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example MDM policy snippet to enforce auto-update (Jamf/Chrome Enterprise)
defaults write com.google.Chrome UpdateDefault -int 1
defaults write com.google.Keystone.Agent checkInterval -int 3600