Description

Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:04.763Z",
  "pubdate": "2026-08-25T21:18:04.763Z",
  "executiveSummary": "This vulnerability involves a Use-After-Free (UAF) flaw within the Bluetooth implementation of Google Chrome on macOS. The defect allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox.\nThe vulnerability is classified with a Medium severity rating by Chromium. Exploitation requires the attacker to employ social engineering techniques, typically tricking a user into navigating to a specifically crafted HTML page.\nSuccessful exploitation compromises the integrity and confidentiality of the host operating system, as the arbitrary code execution occurs beyond the restrictions of the sandboxed browser environment.\nThe flaw affects versions of Google Chrome on macOS prior to 152.0.7977.65. Users are strongly advised to update to the latest version to remediate the risk of remote exploitation.",
  "technicalDetails": "The vulnerability stems from an improper memory management condition within the Bluetooth component of the Google Chrome browser on macOS. A Use-After-Free (UAF) condition occurs when the application continues to reference a memory location after it has been explicitly deallocated.\nIn the context of the Bluetooth implementation, an object representing a Bluetooth device or connection is freed, but a dangling pointer to this memory remains active. If an attacker can trigger the browser to interact with this dangling pointer, they can manipulate the state of the heap or perform controlled memory operations.\nThe attack flow begins when an attacker lures a target user to a malicious webpage containing a crafted payload. This page leverages the browser's Bluetooth API to perform specific operations that trigger the race condition or the faulty state sequence leading to the UAF. By carefully managing the heap layout—a technique often referred to as heap grooming or heap spraying—the attacker can replace the freed memory with attacker-controlled data.\nOnce the dangling pointer is dereferenced and the attacker-controlled memory is accessed, the execution flow is redirected to the attacker's payload. Because this flaw exists in a component that allows escaping the browser sandbox, the injected code executes with the privileges of the user running the browser process rather than being contained within the restricted Chrome sandbox environment.\nThe technical requirements for exploitation involve precise memory synchronization to ensure the dangling pointer is utilized after the reallocation occurs. While the severity is marked as Medium, the ability to escape the sandbox significantly increases the potential impact, as it grants the attacker a foothold on the underlying macOS system, potentially leading to full system compromise or sensitive data exfiltration.\nThis issue affects Google Chrome versions on macOS prior to 152.0.7977.65. There is no specific authentication required for the browser to trigger the vulnerability, provided the user interacts with the malicious content, making it a critical threat to users susceptible to social engineering attacks."
}