CVE-2026-11633: Use after free in Bluetooth in Google Chrome on Mac prior to 149

Synopsis

Use-after-free vulnerability in the Bluetooth stack of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but does require the victim to interact with a malicious peripheral or crafted content delivered through one. Successful exploitation gives an attacker full remote code execution on the affected host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, so the affected Chrome instance must be reachable or browsing content served from a remote source.

• AuthenticationNot required

  No account or credential is needed; the attacker requires no prior authentication to the target system.

• Victim interactionRequired

  The victim must interact with a malicious peripheral or attacker-controlled content, making this a social-engineering or physical-peripheral delivery vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other unpredictable environmental factors.

Blast Radius

• Attacker achieves remote code execution and can run arbitrary processes under the Chrome renderer or browser process account.
• Confidential data accessible to the browser, including stored credentials, cookies, and session tokens, can be read directly.
• Files and data accessible to the logged-in user account can be modified or deleted by the attacker's injected code.
• The affected Chrome process and dependent services can be crashed or destabilized, disrupting the user's session.