CVE-2026-13878: Use after free in Bluetooth in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS affects all Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page; exploitation also requires the attacker to have already compromised Chrome's renderer process. Successful exploitation allows a sandbox escape, giving the attacker code execution outside the Chrome sandbox with access to confidential data, the ability to tamper with the system, and the ability to disrupt services. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable from or directed to an attacker-controlled origin.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched from an unauthenticated network position.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious link a prerequisite.

• Attack complexityDetail

  While the CVSS base complexity is Low (the exploit itself is reliable and condition-free once delivered), a real-world prerequisite exists: the attacker must have already compromised the Chrome renderer process before this flaw enables a sandbox escape.

Blast Radius

• Reads sensitive data from outside the Chrome sandbox, including files, credentials, and tokens accessible to the macOS user account running Chrome.
• Modifies files and system state outside the sandbox, allowing persistent changes or installation of additional malicious software.
• Crashes or disrupts services on the host beyond what Chrome's sandbox would normally permit.
• Combines confidentiality, integrity, and availability impact at high severity, meaning full control of the affected macOS user context is achievable.