CVE-2026-11635: Use after free in Bluetooth in Google Chrome on Mac prior to 149

Synopsis

Use-after-free in the Bluetooth component of Google Chrome on macOS, affecting all Chrome versions prior to 149.0.7827.103. The vulnerability is reachable over the network but requires victim interaction and high attack complexity, and is exploitable only by an attacker who has already compromised the Chrome renderer process. Successful exploitation enables a sandbox escape, giving the attacker full read, write, and availability impact outside the browser's security boundary. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network via a crafted HTML page, so the victim's browser must be reachable and navigating to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed on the target system; the attack is initiated entirely from the attacker side through a crafted page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering-dependent attack that requires the user to take an action.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must already hold a compromised renderer process as a precondition before the use-after-free can be leveraged for sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the host macOS user process.
• Reads files, credentials, and session data accessible to the logged-in macOS user outside the browser sandbox.
• Writes or modifies files on the host filesystem, enabling persistence or further lateral movement.
• Crashes or destabilizes the Chrome process and any dependent services, disrupting availability.