EUVD-2026-40471
GHSA-r3x8-667c-jhvp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page, no privileges, but mandatory user UI interaction sets UI:R; sandbox escape crosses the process boundary giving S:C with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome on macOS before 150.0.7871.47 stems from a use-after-free in the browser's Bluetooth component, letting a remote attacker who lures a user into specific UI gestures on a crafted HTML page corrupt memory and break out of the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, though no public exploit has been identified and EPSS is low (0.22%, 13th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a macOS host running Google Chrome before 150.0.7871.47 and hinges on Chrome's Bluetooth/Web Bluetooth code path being reachable; the CVSS vector's UI:R combined with the description's 'convinced a user to engage in specific UI gestures' means the attack cannot fire fully automatically - the victim must actively interact with the malicious page (the exact gestures are not specified in the data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and warrant a nuanced priority call. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page and lures a macOS Chrome user to it (phishing link, malicious ad, or compromised site). The page invokes Web Bluetooth flows and prompts the victim to perform specific UI gestures; completing them triggers the use-after-free, giving the attacker memory control that can be chained into a sandbox escape. … |
| Remediation | Vendor-released patch: Chrome 150.0.7871.47 for macOS - upgrade to this version or later via the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and restart the browser to apply the fix, since Chrome updates only take effect after relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit macOS device inventory to identify Chrome versions below 150.0.7871.47 using MDM or asset management tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today