CVE-2026-15899 Overview
CVE-2026-15899 is a use-after-free vulnerability in the CameraCapture component of Google Chrome on macOS. The flaw affects Chrome versions prior to 150.0.7871.128 and can be triggered when a user visits a crafted HTML page. Successful exploitation allows a remote attacker to potentially escape the Chrome renderer sandbox. Google's Chromium team rated the security severity as Critical. The vulnerability is classified under CWE-416: Use After Free.
Critical Impact
Remote attackers can leverage a crafted web page to trigger memory corruption in Chrome's camera capture pipeline and potentially escape the browser sandbox on macOS.
Affected Products
- Google Chrome for macOS versions prior to 150.0.7871.128
- Chromium-based components using the affected CameraCapture implementation on macOS
- Downstream Chromium-based browsers on macOS that had not yet integrated the upstream fix
Discovery Timeline
- 2026-07-20 - CVE-2026-15899 published to the National Vulnerability Database (NVD)
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-15899
Vulnerability Analysis
The vulnerability resides in Chrome's CameraCapture subsystem, which manages access to camera devices and mediates capture sessions between the renderer, browser process, and macOS AVFoundation APIs. A use-after-free condition occurs when the component references memory that has already been released. An attacker who serves a crafted HTML page can drive the capture pipeline into an invalid state and cause the freed object to be reused.
Because the flaw sits in a privileged host component reachable from renderer content, exploitation can chain into a sandbox escape. This means malicious JavaScript executed within a compromised renderer may pivot into higher-privileged browser context. User interaction is required, as the victim must load the attacker-controlled page.
Root Cause
The root cause is improper lifetime management of an object handled by CameraCapture on macOS. When one code path releases the underlying allocation while another still holds a reference, subsequent dereferences operate on freed memory. Attackers can influence heap layout so that the reused allocation contains attacker-controlled data, converting the dangling pointer into a controllable primitive.
Attack Vector
An attacker hosts a crafted HTML page containing JavaScript and media capture calls that manipulate the CameraCapture lifecycle. When a macOS Chrome user visits the page, the sequence triggers the use-after-free. Combined with a heap grooming primitive, the flaw can enable code execution outside the renderer sandbox.
No public proof-of-concept is currently listed for CVE-2026-15899, and the issue is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry for the vendor's technical record.
Detection Methods for CVE-2026-15899
Indicators of Compromise
- Chrome renderer or GPU process crashes on macOS with stack frames referencing CameraCapture or media capture components
- Unexpected getUserMedia prompts or camera activations initiated by newly visited domains
- Child processes spawned by Chrome that write to unusual paths after a browsing session involving untrusted media-heavy sites
Detection Strategies
- Inventory installed Chrome versions across macOS endpoints and flag any build below 150.0.7871.128
- Correlate Chrome crash telemetry with URL history to identify pages that consistently trigger crashes in media components
- Monitor for post-exploitation behavior typical of browser sandbox escapes, such as unsigned binary execution from Chrome cache or temp directories
Monitoring Recommendations
- Enable macOS Endpoint Security Framework telemetry for process creation, file writes, and code signing anomalies originating from Chrome helper processes
- Track outbound network connections from Chrome helper processes to newly registered or low-reputation domains
- Alert on modifications to LaunchAgents, LaunchDaemons, or login items shortly after Chrome activity referencing untrusted pages
How to Mitigate CVE-2026-15899
Immediate Actions Required
- Update Google Chrome on macOS to version 150.0.7871.128 or later across all managed devices
- Force-close and relaunch Chrome after installing the update so the patched binary is loaded
- Audit third-party Chromium-based browsers on macOS and apply their corresponding security releases
Patch Information
Google addressed CVE-2026-15899 in the Chrome Stable channel for desktop. macOS users should upgrade to Chrome 150.0.7871.128 or later. Deployment details are published in the Google Chrome Desktop Update release notes. Enterprise administrators can push the update via MDM, Google Chrome Enterprise Bundle, or standard software distribution tooling.
Workarounds
- Restrict camera and microphone permissions in Chrome site settings until the patch is deployed
- Enforce a browser allowlist through MDM to block navigation to untrusted sites on unpatched macOS hosts
- Disable media capture APIs via enterprise policy VideoCaptureAllowed where camera use is not required for business workflows
# Enforce Chrome auto-update and disable video capture on macOS via managed policy
defaults write com.google.Chrome VideoCaptureAllowed -bool false
defaults write com.google.Chrome DefaultMediaStreamSetting -int 2
defaults write com.google.Chrome UpdateDefault -int 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
