CVE-2026-15119: Chrome GetUserMedia Race Condition Sandbox Escape

Technical summary

CVE-2026-15119 is a race condition (CWE-362) in the GetUserMedia implementation of Chromium/Chrome that creates a window for sandbox escape. The vulnerability exists in versions prior to 150.0.7871.115 and requires an attacker to have already obtained renderer process code execution. The attacker crafts a malicious HTML page that exploits timing conditions in the media API handling to bypass sandbox isolation mechanisms. The Chromium security team assigned this a High severity rating due to the potential for sandbox escape, which would grant attacker access to the system beyond the browser's confinement.

Business impact

A successful exploit could allow attackers who have compromised the Chrome renderer process to gain system-level code execution, potentially enabling data theft, malware installation, or lateral movement to other systems. For organizations relying on Chrome's sandbox as a security boundary, this vulnerability temporarily weakens that assurance until patching is complete. The practical risk is moderated by the requirement for a prior renderer compromise, which itself requires separate vulnerability exploitation or social engineering.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. Chromium-based browsers derived from affected Chromium versions may also be impacted depending on their patch status. Verify the specific version in your environment and check whether your Chromium-derived browser (Edge, Brave, Opera, etc.) has backported the fix.

Exploitability

Exploitation requires two preconditions: (1) the attacker must already have code execution in the Chrome renderer process, typically through a separate vulnerability or social engineering, and (2) the user must interact with the malicious HTML page. The race condition nature means successful exploitation may be unreliable and could require multiple attempts. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, and no public weaponized exploits have been disclosed at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. This update addresses the race condition in GetUserMedia handling. For organizations using Chromium-based browsers, verify that the respective vendor has backported this fix into their release line.

Patch guidance

Chrome will automatically update to 150.0.7871.115 on the next restart for most users with auto-update enabled. Enterprise deployments using Chrome Enterprise or Chrome Browser Cloud Management should verify update policies and push the patch through their management console to ensure timely deployment. Test the patched version in a non-production environment first to validate compatibility with any custom applications or extensions that interact with media APIs.

Detection guidance

Monitor Chrome process execution and look for suspicious renderer process behavior, particularly heap corruption indicators or abnormal memory access patterns around media API calls. EDR solutions should flag attempts to spawn processes from the Chrome renderer with unusual privileges or system access. Network-based detection is limited since the attack surface is within the browser; focus on behavioral analytics post-compromise. Check browser console logs for unusual JavaScript activity or failed media API calls that might indicate exploitation attempts.

Why prioritize this

This vulnerability merits rapid patching (within 30 days) because sandbox escape elevates a renderer compromise into a full system compromise. However, it is not emergency-tier because the attack requires a prior renderer vulnerability and user interaction. Prioritize patching for systems handling sensitive data or exposed to untrusted content. Organizations with strong application sandboxing, user privilege restrictions, and endpoint detection will experience reduced risk from this flaw.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects high impact (confidentiality, integrity, and availability all affected) balanced against moderate attack complexity due to the race condition and requirement for prior renderer compromise. The user interaction requirement and contextual factors (attacker must already have renderer code execution) prevent this from reaching Critical severity. The score appropriately weights the sandbox escape potential against the multi-stage attack chain required.

Frequently asked questions