External risk intelligence

Chrome CameraCapture Use After Free Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-15899

This vulnerability exists within a client-side web browser application. It requires a user to interact with a crafted HTML page, meaning it is not a public-facing service, gateway, or edge component reachable via autonomous internet connections.

Use After Free

Google Chrome

before 150.0.7871.128

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in Google Chrome on Mac that could allow attackers to escape the browser's security sandbox. This vulnerability, triggered by visiting a malicious webpage, has the potential to impact user security by allowing unauthorized access to system resources. The main concern is confirming relevance and exposure given the client-side nature of the vulnerability.

A flaw allows browser escape from malicious websites.
Security risk requires user interaction to exploit.
Confirm relevance and exposure for Mac Chrome users.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page, leading to a use-after-free vulnerability in Chrome's CameraCapture feature. This could then allow the attacker to break out of the browser's sandbox.

Requires user interaction with a malicious page.
Vulnerability in CameraCapture feature.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's CameraCapture feature, when a user visits a malicious webpage, could allow an attacker to break out of the browser's sandbox on macOS. This means an attacker could potentially gain broader access to the operating system than intended.

Affects system data outside the browser sandbox.
Via a crafted HTML page on macOS.
Potential for system-wide compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chrome browser is the affected technology, and the vulnerability resides within the CameraCapture component. Responsibility likely falls to end-user device management or endpoint security teams to identify affected instances, assess business criticality, and coordinate remediation. The immediate first step is to locate all deployments of the affected Chrome version and determine their exposure and impact.

Own the issue via endpoint management.
Verify user exposure and browser reachability.
Plan for user-impacting updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's CameraCapture component?

CameraCapture is a technical feature within the Google Chrome web browser designed to handle hardware interactions when a website requests access to your computer's camera. It manages the data stream between the browser's isolated environment and the macOS camera hardware, ensuring that web pages can only access video input when explicitly authorized by the user.

What does CWE-416 mean for CVE-2026-15899?

CWE-416 is a 'Use After Free' vulnerability. In simple terms, the software incorrectly continues to use a memory location after it has already been cleared or released. In this specific case, an attacker can manipulate this memory error to corrupt the browser's logic, which creates a path for them to bypass the security restrictions meant to keep the browser isolated from the rest of your operating system.

How is this Chrome vulnerability triggered?

This flaw is triggered when a user navigates to a specifically crafted, malicious HTML page. It does not activate simply because the browser is open or connected to the internet; the browser must actively process the deceptive code on that page. If a user does not visit a compromised or malicious site, the vulnerable code path within CameraCapture remains dormant.

Is my computer at risk if Chrome is not internet-facing?

According to Halo Surface Signal, this vulnerability is classified as unlikely to be triggered by autonomous network attacks because it is a client-side browser issue. Since it requires a user to interact with a specific page, the risk depends on user activity rather than whether the device itself is configured as a public-facing service or an internal workstation.

How do I address this Chrome security update?

The primary step is to identify all macOS devices in your environment running Chrome versions prior to 150.0.7871.128. Since this is an end-user application, coordinate with your IT or endpoint management teams to ensure these browsers are updated to the latest patched version provided by Google, which resolves the memory management error and restores proper sandbox protections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.