CVE-2026-11699: Use after free in Bluetooth in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability exists in the Bluetooth component of Google Chrome on macOS, affecting all versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but does require the target user to visit a crafted HTML page. Successful exploitation causes heap corruption that gives the attacker full read, write, and crash capability over the browser process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page, so the Chrome instance must be reachable from an internet or network context.

• AuthenticationNot required

  No account, session token, or credential of any kind is required before the attack can be launched.

• Victim interactionRequired

  The target user must visit or be redirected to an attacker-controlled HTML page, making this a social-engineering or malicious-link delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker gains the ability to read arbitrary memory within the Chrome browser process, exposing session cookies, saved credentials, and page content from open tabs.
• The attacker can write to heap memory, enabling code execution within the browser process at the privilege level of the logged-in macOS user.
• The attacker can crash the browser process or destabilize the heap in ways that make the application unresponsive, causing a denial-of-service condition for the user.
• Because Chrome on macOS may have access to Bluetooth peripherals, heap corruption in the Bluetooth component may allow interaction with or enumeration of paired Bluetooth devices.