EUVD-2026-35235
GHSA-qfhp-x82v-ppcm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome on macOS prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Bluetooth component, triggered by a crafted HTML page. Chromium rates the severity as Critical, and a vendor patch is available; no public exploit has been identified at time of analysis, though the bug is tracked in the Chromium issue tracker (516987814).
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a prior compromise of the Chrome renderer process - this CVE is a sandbox-escape primitive, not an initial-access bug, so a separate renderer RCE or comparable in-renderer code execution must be chained first. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningful but conditional. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user with a vulnerable Chrome on macOS visits an attacker-controlled or compromised site (the UI:R interaction), where a first-stage exploit - a separate, prior renderer RCE - gains code execution inside the sandboxed renderer. The attacker then loads a crafted HTML page that drives the Web Bluetooth IPC pathway to trigger the use-after-free, reclaims the freed object with attacker-controlled data, and pivots code execution into the browser process, escaping the sandbox to access the user's files, keychain-protected secrets, and persistent state. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via Chrome's built-in updater or by redeploying the managed package, then ensure end users restart the browser so the update actually takes effect (Chrome staying open indefinitely is a common reason patches don't land). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all macOS endpoints running Chrome pre-149.0.7827.103; notify users and prepare push deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today