CVE-2026-13785: Use after free in Bluetooth in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS affects all Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but the attacker must convince a user to perform specific UI gestures on a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker the ability to read sensitive data, modify files or data, and crash processes outside the Chrome renderer sandbox. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from an external or internet-facing network position.

• AuthenticationNot required

  No account, session token, or credential of any kind is required before the attacker can attempt exploitation.

• Victim interactionRequired

  The attacker must socially engineer the target user into visiting a crafted HTML page and performing specific UI gestures within the Chrome browser.

• Attack complexityDetail

  The exploit is reliable and imposes no race-condition or memory-layout prerequisites on the attacker once the user completes the required gestures.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and executes arbitrary code in a higher-privilege process on the macOS host.
• Confidential data accessible to the Chrome process (stored credentials, session cookies, browsing history) is exposed to the attacker.
• The attacker can write or modify files and data accessible to the compromised process outside the sandbox boundary.
• The attacker can crash the browser process or dependent system services, disrupting availability for the affected user.