CVE-2026-11698: Use after free in Bluetooth in Google Chrome on Mac prior to 149

Synopsis

Use-after-free in the Bluetooth component of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.103. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a crafted HTML page. Successful exploitation causes heap corruption that gives an attacker full read, write, and execution capability inside the Chrome process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed on the target system; any user browsing to the malicious page is at risk.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector requiring the attacker to lure the user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout prerequisites.

Blast Radius

• An attacker gains the ability to read heap memory inside the Chrome process, exposing stored credentials, session tokens, and decrypted page content.
• Heap corruption enables arbitrary writes within the Chrome process, allowing modification of in-memory state such as security flags and DOM structures.
• The combination of read and write primitives from this class of heap corruption typically enables arbitrary code execution at the privilege level of the Chrome renderer process.
• A crashed or hijacked Chrome process disrupts the browsing session, causing denial of service for the affected user.