Google Chrome CVE-2026-11698

Exploitation requires the victim to be running Google Chrome on macOS at a version prior to 149.0.7827.103 and to navigate the browser to attacker-controlled HTML content (UI:R in the CVSS vector). The vulnerable code path is reached through the Web Bluetooth JavaScript API, which is enabled by default in Chrome and does not require an authenticated session or any preconfiguration on the victim's machine; however, browsing-prompted permission dialogs for selecting specific Bluetooth devices may not be required to reach the freed-object code path since the bug can manifest during API setup. The vulnerability is scoped to macOS builds - Chrome on Windows, Linux, ChromeOS, Android, and iOS is not implicated by the advisory text. Enterprises that have disabled Web Bluetooth via DefaultWebBluetoothGuardSetting policy will not be exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects a classic drive-by browser vulnerability: network-reachable, low complexity, no privileges, but user interaction (visiting a page) required, with high CIA impact. CISA's SSVC assessment of Exploitation=none and Automatable=no tempers urgency - there is no observed exploitation and the bug is not trivially scalable into a wormable attack - while Technical Impact=total reinforces that successful exploitation yields full control of the browser process. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so this is no public exploit identified at time of analysis. The realistic priority is high for macOS Chrome fleets because UAF bugs in Chromium are routinely chained into sandbox escapes by sophisticated actors, but it is not at emergency-zero-day priority absent active exploitation reporting.

An attacker hosts or compromises a webpage that, when loaded in an unpatched Chrome on macOS, invokes the Web Bluetooth API in a sequence that triggers the use-after-free and grooms the heap so the dangling pointer dereferences attacker-controlled data, yielding code execution in the browser process. The victim only needs to click a phishing link, malvertising creative, or watering-hole site - no further interaction beyond visiting the page is required. No public exploit has been identified at time of analysis, but Chromium UAFs of this class are commonly developed into reliable exploits by commercial spyware vendors.