Description

Use after free in Bluetooth in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:15.977Z",
  "pubdate": "2026-08-25T21:18:15.977Z",
  "executiveSummary": "A high-severity Use-After-Free (UAF) vulnerability exists within the Bluetooth implementation of Google Chrome, affecting versions prior to 152.0.7977.65.\nThe vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox by leveraging social engineering techniques.\nThe flaw stems from improper memory management within the Bluetooth component, which can be triggered via a maliciously crafted Chrome extension.\nSuccessful exploitation poses a critical risk to system integrity and confidentiality, as it enables the execution of unauthorized code with privileges exceeding those of the sandboxed renderer process.\nThis vulnerability highlights a significant escalation vector where interaction with a malicious extension facilitates a break-out from the browser's internal security architecture.\nWhile social engineering is a prerequisite for delivery, the resulting impact on a compromised system is severe due to the potential for full system exploitation.",
  "technicalDetails": "The vulnerability is identified as a Use-After-Free (UAF) condition located within the Bluetooth subsystem of the Google Chrome browser. A UAF vulnerability occurs when a software application continues to use a memory pointer after that memory has been explicitly freed or deallocated. In this specific implementation, the Bluetooth component fails to nullify or properly manage references to memory objects during specific asynchronous operations or state transitions.\nThe exploitation flow begins with the delivery of a crafted Chrome extension designed to interact with the browser's Bluetooth API. An attacker employs social engineering to convince a user to install or interact with this malicious extension. Once installed, the extension initiates specific requests or sequences of Bluetooth operations that trigger the vulnerable memory management routine.\nBy manipulating the lifecycle of objects within the Bluetooth component—specifically by inducing a race condition or a premature destruction of an object while a secondary pointer retains a reference to the freed address—an attacker can reclaim the memory location for malicious data. When the browser later attempts to access the stale pointer, it executes or processes the attacker-controlled data instead of valid object structures.\nBecause the vulnerability exists in a way that allows for arbitrary code execution outside the browser's sandbox, it implies that the memory corruption leads to a control-flow hijacking event that bypasses the restrictive security boundaries intended to isolate the renderer process from the host operating system. The attacker achieves this by carefully grooming the heap to place payloads in the previously freed memory space, effectively redirecting the execution pointer to malicious shellcode or a return-oriented programming (ROP) chain.\nThe impact is significant, as the code executes with the privileges of the browser process or potentially higher, depending on the specific host environment and the success of the sandbox escape mechanism. This vulnerability affects all Google Chrome installations below version 152.0.7977.65 that utilize the Bluetooth API implementation. The lack of proper reference counting or state tracking within the Bluetooth component serves as the primary technical root cause, allowing for the transition from a memory safety violation to a complete subversion of the application's runtime environment."
}