Google Chrome EUVD-2026-35254

Target must be running Google Chrome on macOS at a version below 149.0.7827.103, and the victim must perform user interaction by loading attacker-controlled HTML in that browser (UI:R in the CVSS vector). No authentication or prior foothold is required (PR:N), and the attack is delivered over the network (AV:N) at low complexity (AC:L). The exploitation path runs through the CameraCapture subsystem reachable from the renderer; non-Mac Chrome builds are not listed as affected in the provided data, and Chromium forks are out of scope of this CVE unless their vendors confirm inheritance.

Signals are largely aligned toward serious risk: CVSS 9.6 with AV:N/AC:L/PR:N/S:C/C:H/I:H/A:H indicates a low-complexity, network-reachable, unauthenticated attack with cross-component impact, and the affected primitive (sandbox escape) is exactly the class Google rates 'High' internally. The single mitigating factor in the vector is UI:R - a user must visit attacker-controlled content. EPSS and CISA KEV data were not provided in the input, so probability of exploitation and active-exploitation status cannot be quantified here; treat as 'no public exploit identified at time of analysis' until KEV or exploit telemetry says otherwise. The 'Denial Of Service' tag conflicts with the H/H/H impact and sandbox-escape framing in the description - the description is the more authoritative signal, and the tag should not be used to downgrade priority. Net assessment: this is a real priority for any Mac fleet running Chrome, not a high-CVSS-but-low-real-risk case, given the sandbox-escape consequence and trivial delivery (visit a page).

An attacker hosts a malicious HTML page (or injects it via a malvertising chain) that, when visited by a Mac user running an unpatched Chrome, drives the WebRTC/getUserMedia surface in a way that triggers the use-after-free in CameraCapture. By spraying the freed allocation with attacker-controlled data the attacker corrupts a freed object's vtable or callback pointer, gaining code execution that escapes the renderer sandbox (S:C in the CVSS vector) and runs in a more privileged Chrome process context. No public exploit identified at time of analysis, but the bug class and the existence of the Chromium issue tracker entry make weaponization by skilled researchers plausible.