Google Chrome CVE-2026-15119

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (a first-stage renderer RCE is a hard prerequisite - this bug alone does not grant initial access), plus victim user interaction (UI:R) to load a crafted HTML page that exercises the GetUserMedia code path. The specific feature required is Chrome's Media Capture / GetUserMedia flow. Because the defect is a race condition (AC:H), exploitation further depends on reliably winning a narrow timing window, which limits reliability. Limiting factors: the pre-required renderer compromise, the need for user interaction, race-timing difficulty, and applicability only to Chrome desktop builds below 150.0.7871.115.

The official CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H = 8.3) reflects high impact and scope change, but several signals temper real-world urgency. AC:H encodes the difficulty of reliably winning a race, and the description states the attacker must have ALREADY compromised the renderer process - a material prerequisite the PR:N metric does not capture, since PR:N here refers only to the initial web delivery. This is therefore a chain component, not a standalone one-click compromise. No EPSS score, KEV listing, or SSVC decision data was provided; there is no public exploit identified at time of analysis. Chromium's own 'High' (not 'Critical') rating is consistent with a sandbox-escape-requiring-renderer-RCE profile. Net: a genuine priority for browser fleets because Chrome is ubiquitous and sandbox escapes are valuable, but exploitation realistically requires a full exploit chain and precise race timing, so this is not a mass-scannable internet-facing target. Note the conflict to verify: PR:N implies no privileges yet the description requires a pre-compromised renderer - treat the 'PR:N' as delivery-stage only.

An attacker first achieves code execution in the Chrome renderer (for example via a separate exploited web bug) when a victim visits an attacker-controlled page, then serves crafted HTML/JS that repeatedly drives GetUserMedia operations to trigger the race. By winning the timing window, the renderer manipulates shared media state to corrupt the more-privileged browser process and escape the sandbox, gaining code execution at browser-process privilege on the host. No public exploit is identified at time of analysis, and success depends on both a prior renderer compromise and reliable race timing (CVSS AC:H, UI:R).