CVE-2026-11654General(apple / chrome)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apple chrome systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

1.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome
  • macos

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 4 classified signals
  • Peaked 4d ago at 1 mentions (2026-06-09); latest day: 1
  • 5 total mentions across 5 days

Affected systems

Products
chromemacos

1 version affected across 2 products

Deep dive

Activity timeline5 mentions / 5d
00111Mentions · 2026-06-09: 1Mentions · 2026-06-24: 1Mentions · 2026-07-03: 1Mentions · 2026-07-08: 1Mentions · 2026-07-10: 1Patch / Workaround · 2026-06-09: 1Technical Details · 2026-06-09: 106-0906-2407-0307-0807-10
Signal classification2 categories
General
480.0%
Patch
120.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-091
Patch1
2026-06-241
General1
2026-07-031
General1
2026-07-081
General1
2026-07-101
General1
Full discourse5 posts
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【緊急】CVE-2026-11654 Google Chrome 149.0.7827.103以前のMac版に深刻な脆弱性|即時対応が必要 https://www.cybernote.click/2026/07/02/cve-2026-11654-google-chrome-14907827103mac/ #IT #Security #cybersecurity

    Post summary

    The post alerts to CVE‑2026‑11654 as a critical flaw in older macOS versions of Chrome, but provides no proof‑of‑concept, exploit details, patch info, or evidence of active exploitation.

    0000152
    209 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【緊急】CVE-2026-11654 Google Chrome 149.0.7827.103以前のMac版に深刻な脆弱性|即時対応が必要 https://www.cybernote.click/2026/07/02/cve-2026-11654-google-chrome-14907827103mac/ #IT #Security #cybersecurity

    Post summary

    The tweet alerts to a critical vulnerability (CVE‑2026‑11654) in older macOS versions of Chrome 149.0.7827.103 and urges immediate action, but offers no further details on exploitation or remediation.

    0000057
    206 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【緊急】CVE-2026-11654 Google Chrome 149.0.7827.103以前のMac版に深刻な脆弱性|即時対応が必要 https://www.cybernote.click/2026/07/02/cve-2026-11654-google-chrome-14907827103mac/ #IT #Security #cybersecurity

    Post summary

    The post announces a new vulnerability (CVE-2026-11654) affecting older Mac versions of Google Chrome, urging immediate action, but provides no technical specifics, PoC, or remediation details.

    0000054
    208 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【緊急】CVE-2026-11654 Google Chrome 149.0.7827.103以前のMac版に深刻な脆弱性|即時対応が必要 https://www.cybernote.click/2026/06/22/cve-2026-11654-google-chrome-14907827103mac/ #IT #Security #cybersecurity

    Post summary

    The post announces a severe CVE-2026-11654 affecting Chrome for Mac before 149.0.7827.103, but provides no technical, exploit, or mitigation details.

    0000049
    208 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Three Browser Flaws Patched in Google Chrome 149 (CVE-2026-11654, CVE-2026-11659, CVE-2026-11697) Google's June 2026 Chrome Stable update fixes these three among 74 security issues. CVE-2026-11654 is a use-after-free in the CameraCapture component (macOS). A victim visiting a crafted HTML page can trigger freed-memory access and potentially a renderer sandbox escape - CISA scored it 9.6. CVE-2026-11659 and CVE-2026-11697 are insufficient-validation-of-untrusted-input issues in the UI component, both rated High by Chromium, where crafted input can bypass the browser's validation logic. CVSS scores for these two are still pending. Because Chromium is shared, downstream browsers like Edge, Brave, Opera, and Vivaldi inherit the same fixes. None of these three is the in-the-wild bug in this update (that is a separate V8 flaw). 👉Upgrade to Chrome 149.0.7827.102/.103 (Windows/Mac) or 149.0.7827.102 (Linux).

    Post summary

    The update announces the patching of three high‑severity Chrome vulnerabilities (CVE‑2026‑11654, 11659, 11697), details their technical nature, and advises users to install the fixed Chrome 149.0.7827.102/.103 releases.

    00000143
    207 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
OSapplemacos---
Appgooglechrome---

Explore more