CVE-2026-9881: Use after free in Bluetooth in Google Chrome on Mac prior to 148

Synopsis

Use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS affects versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, though exploitation depends on convincing a target to install a malicious Chrome extension. Successful exploitation enables a full sandbox escape, giving the attacker read, write, and denial-of-service capability beyond the browser's isolation boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack is delivered over the network, meaning the attacker must be able to reach the target through a network-accessible vector such as a malicious extension served remotely.

• AuthenticationNot required

  No authentication is needed; the attacker requires no account or credentials on the target system before exploitation.

• Victim interactionRequired

  The attacker must convince the user to install a malicious Chrome extension, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must engineer specific conditions (such as precise memory state or timing) beyond just delivering the malicious extension.

Blast Radius

• Successful sandbox escape lets the attacker execute arbitrary code outside the Chrome renderer sandbox, breaking the browser's primary isolation boundary on the host macOS system.
• The attacker gains read access to files, credentials, and session tokens stored on the host that Chrome's sandbox would normally block.
• The attacker can write or modify data on the host filesystem and inject into other processes running under the same or elevated user context.
• The attacker can crash or destabilize host-level services, causing denial of service beyond the browser process itself.