Google Chrome EUVD-2026-35225

Exploitation requires the victim to be running Google Chrome on macOS at a version prior to 149.0.7827.103 and to load attacker-controlled HTML/JavaScript in that browser (UI:R). No authentication, no prior access, and no special server-side configuration is needed on the attacker's part, but the victim's browser must reach the malicious origin and must have the Web Bluetooth code path reachable - enterprise deployments that have set DefaultWebBluetoothGuardSetting to BlockWebBluetooth are not exposed. The vulnerability is scoped to the macOS build per the description; Windows and Linux Chrome are not listed as affected, which materially limits the impacted population.

The CVSS 8.8 score reflects network attack vector, low complexity, no privileges required, and high impact across confidentiality, integrity, and availability - but UI:R (user interaction required) means the victim must visit a malicious page, which tempers drive-by-style mass exploitation. CISA's SSVC framework rates exploitation as 'none' and automatable as 'no', though technical impact is 'total', and there is no public exploit identified at time of analysis and the CVE is not on the CISA KEV list. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The realistic risk is moderate-to-high for macOS Chrome users: Chrome use-after-free vulnerabilities are historically attractive to commercial spyware vendors and are routinely chained with sandbox escapes, so while there is no evidence of in-the-wild abuse today, the bug class and target browser warrant prompt patching rather than deferred treatment.

A remote attacker hosts a crafted HTML page containing JavaScript that invokes Web Bluetooth APIs in a sequence that frees an internal Bluetooth-related object and then reuses the dangling reference with attacker-shaped heap content. A macOS user running a vulnerable Chrome build is lured to the page via phishing, malvertising, or a watering-hole compromise, triggering heap corruption that the attacker grooms into arbitrary code execution inside the renderer, typically as the first stage of a chain that pairs with a sandbox escape for full device compromise. No public exploit is identified at time of analysis.