CVE-2026-14043: Use after free in GetUserMedia in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in the GetUserMedia component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires the victim to visit a malicious page, but no authentication is needed. Successful exploitation gives the attacker full code execution outside the sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page served from a remote host.

• AuthenticationNot required

  No account or credentials are needed; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making social engineering (phishing link, malicious ad, or redirected URL) a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond an already-compromised renderer process.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code at the privilege level of the Chrome process on the host, breaking out of the browser's isolation boundary.
• The attacker reads sensitive data accessible to the Chrome process, including stored credentials, session cookies, and files the browser user can access on disk.
• The attacker modifies local files, browser profile data, or system configuration within the reach of the Chrome process user account.
• The attacker can crash or destabilize the browser or trigger denial-of-service conditions on the host process.