CVE-2026-9964: Use after free in Bluetooth in Google Chrome on Mac prior to 148

Synopsis

Use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS affects all Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires high attack complexity, and no authentication is needed; exploitation requires convincing a user to install a malicious Chrome extension. Successful exploitation gives an attacker arbitrary code execution on the affected host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack is delivered over the network, meaning the attacker must be able to reach the victim's browser session or distribution channel remotely to deliver the malicious extension.

• AuthenticationNot required

  No authentication or existing account on the target system is required to attempt exploitation.

• Victim interactionRequired

  The attacker must socially engineer the target user into installing a crafted malicious Chrome extension before the vulnerability can be triggered.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on environmental conditions or timing factors beyond the attacker's direct control, reducing reliability.

Blast Radius

• A successful exploit executes arbitrary code in the context of the Chrome process on the affected Mac host.
• The attacker can read sensitive data accessible to the browser, including stored credentials, session tokens, and browsing history.
• The attacker can write or modify data accessible to the Chrome process, including locally cached files and extension storage.
• The Chrome process can be crashed or made unresponsive, disrupting browser availability for the affected user.