CVE-2026-11654: Use after free in CameraCapture in Google Chrome on Mac prior to 149

Synopsis

Use-after-free in the CameraCapture component of Google Chrome on macOS allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does require the victim to visit a malicious page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, enabling full read, write, and disruption of the host process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach and load the crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit the attacker-controlled page in Chrome on macOS, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental preconditions.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process on the host macOS system.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the browser process on disk and in memory.
• The attacker writes or modifies files and browser-managed data stores on the host, including cookies, saved passwords, and local storage.
• The attacker crashes or destabilizes the browser process and any dependent services, causing service disruption for the affected user session.