EUVD-2026-35241
GHSA-v7j2-vv57-hgqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure user to crafted HTML page
-
DeliveryPage invokes Web Bluetooth API
-
ExploitUser performs required UI gesture
-
InstallTrigger use-after-free in Bluetooth code
-
C2Heap grooming and dangling-pointer reuse
-
ExecuteAchieve code execution in renderer
-
ImpactChain sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must be running Google Chrome on Windows at a version below 149.0.7827.103 and must visit attacker-controlled HTML content. The user must perform specific UI gestures - consistent with the Web Bluetooth permission/chooser flow that requires an explicit user action to expose BLE devices to a page - meaning a fully silent drive-by is not possible. The Web Bluetooth feature must be enabled (it is on by default in Chrome on Windows but can be disabled via enterprise policy). High attack complexity (AC:H) per the CVSS vector implies the attacker also needs reliable heap grooming and likely a paired sandbox escape for full system compromise; non-Windows platforms and Chromium forks that have already rebased past 149.0.7827.103 are not exploitable. |
| Impact | The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H paints a nuanced picture: network reachable and unauthenticated, but with both high attack complexity and required user interaction (specific UI gestures), which materially limits drive-by exploitation. Chromium internally rates this Critical, which conflicts with the NVD CVSS of 7.5 (High) - Google's rating reflects sandbox-escape or RCE potential, while CVSS dampens the score due to UI:R and AC:H. EPSS and CISA KEV data are not provided in the input, so exploitation probability cannot be quantified, and there is no public exploit identified at time of analysis. Use-after-free bugs in Chrome's Bluetooth code have historically been weaponized once details become public, so despite the user-interaction barrier this should be treated as a high-priority browser patch - particularly on Windows endpoints where users may be coaxed into BLE pairing-style prompts. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Windows Chrome user via phishing or a malvertising redirect; the page invokes the Web Bluetooth API and prompts the user to perform specific UI gestures (such as accepting a device chooser dialog) which trigger the use-after-free in the Bluetooth code path. With heap grooming, the attacker corrupts memory to gain code execution inside the renderer process, then chains a separate sandbox escape to run arbitrary code on the host. No public exploit identified at time of analysis, but Chromium classifies the severity as Critical, indicating Google's internal assessment of exploit feasibility. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome on Windows prior to 149.0.7827.103 can be triggered via a use-after-free flaw in the Bluetooth component, allowing a remote attacker to execute arbitrary code when a victim visits a crafted HTML page and performs specific UI gestures. Chromium rates the severity as Critical, though the CVSS 3.1 score of 7.5 reflects high attack complexity and required user interaction. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 for Windows - upgrade to this Stable channel build or later, as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Managed environments should force-update via Chrome's Group Policy (RelaunchNotification and TargetVersionPrefix) or enterprise deployment tooling rather than waiting for background updates. Users of downstream Chromium browsers on Windows should monitor their vendor's advisories and apply the equivalent rebase. As an interim compensating control until patching is complete, disable Web Bluetooth by setting the DefaultWebBluetoothGuardSetting policy to 2 (block), which prevents sites from requesting Bluetooth access at the cost of breaking legitimate Web Bluetooth applications (a small population in most enterprises). Restricting browsing to trusted sites via SitePerProcess and SafeBrowsing enhanced protection further reduces the chance a victim reaches a malicious crafted page.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Web Bluetooth implementation, which exposes the Bluetooth GATT API to web pages so they can discover and communicate with nearby BLE devices. CWE-416 (Use After Free) indicates that an object in the Bluetooth subsystem is freed while a reference to it remains in use, allowing an attacker to manipulate the dangling pointer and corrupt memory. Successful exploitation typically leads to controlled heap corruption inside the renderer or browser process, which on Chromium-based browsers is a well-known stepping stone toward arbitrary code execution when combined with appropriate heap grooming. The defect is Windows-specific per the description, suggesting either a platform-specific code path in the Windows Bluetooth backend or a bug exposed only by Windows BLE stack behavior.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome on Windows users are vulnerable to remote code execution (CVE-2026-11641) through malicious websites, with potential to compromise employee systems and organizational data. No public exploit has been identified at time of analysis, but the vulnerability requires only user interaction to trigger arbitrary code execution. A vendor patch is available, allowing organizations to eliminate this risk through timely deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB