CVE-2026-11641: Use after free in Bluetooth in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Bluetooth component of Google Chrome on Windows, affecting all versions prior to 149.0.7827.103. The flaw is reachable over the network but requires a victim to perform specific UI gestures on a crafted HTML page, and no authentication is needed from the attacker. Successful exploitation gives the attacker arbitrary code execution in the context of the browser process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is required from the attacker; the exploit is delivered through a web page with no prior authentication.

• Victim interactionRequired

  The victim must perform specific UI gestures on the crafted page, requiring the attacker to socially engineer the target into taking those actions.

• Attack complexityDetail

  Attack complexity is high, meaning successful exploitation depends on environmental factors or precise timing conditions beyond the attacker's direct control.

Blast Radius

• The attacker achieves arbitrary code execution inside the Chrome browser process on the victim's Windows host.
• Confidential data accessible to the browser, including stored credentials, session tokens, and local files readable by the Chrome process, is exposed.
• The attacker can write or modify data accessible to the browser process, including cached content and profile data on disk.
• The browser process can be crashed or made to behave arbitrarily, disrupting the user's session and any dependent browser-hosted workloads.