What is the CVSS score of EUVD-2026-39047?

EUVD-2026-39047 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-39047?

A use-after-free vulnerability in Google Chrome for macOS (versions before 149.0.7827.197) enables attackers to execute arbitrary code through malicious Bluetooth devices, creating risk of complete…. A patch is available.

How to fix or mitigate EUVD-2026-39047?

Within 24 hours: Communicate vulnerability to macOS user base and request immediate Chrome update to version 149.0.7827.197 or later; add notice about avoiding unknown Bluetooth connections. Within 7 days: Verify Chrome update adoption on 80%+ of macOS fleet through endpoint telemetry; identify and manually update any non-compliant machines. Within 30 days: Achieve 100% Chrome 149.0.7827.197+ adoption; review Bluetooth connection policies and consider restricting or logging Bluetooth device connections on macOS endpoints.

Google Chrome EUVD-2026-39047

| CVE-2026-13035 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-r2jr-m2rh-f5hg

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Attack relies on a proximate malicious Bluetooth peripheral, so AV:A rather than AV:N; UI:R because the user must grant Bluetooth access; no privileges needed and full RCE impact.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:34 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for macOS prior to 149.0.7827.197 stems from a use-after-free in the browser's Bluetooth subsystem, letting a malicious Bluetooth peripheral corrupt memory and execute arbitrary code in the browser process. The flaw is rated High severity by Chromium with a CVSS 8.8, requires user interaction (UI:R) but no privileges, and currently has no public exploit identified at time of analysis; CISA SSVC marks exploitation status as none.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in Chrome's Bluetooth stack on macOS, which underpins the Web Bluetooth API allowing web pages to communicate with nearby BLE/Bluetooth peripherals. A use-after-free occurs when memory referencing a Bluetooth object (such as a device, GATT service, or characteristic handle) is freed but a dangling pointer continues to be dereferenced, allowing an attacker who controls the peripheral's responses to manipulate freed heap memory, achieve a controlled allocation, and ultimately hijack control flow. CPE data confirms the affected product is cpe:2.3:a:google:chrome, and the platform is specifically the macOS build, where Chrome's Bluetooth backend integrates with Apple's CoreBluetooth/IOBluetooth frameworks. Such bugs in browser Bluetooth code are typically reachable when a user grants a site access to a Bluetooth device or when the browser processes responses from a paired/connected peripheral.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to 149.0.7827.197 or later, which is the fixed Stable channel release per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html; trigger Chrome's built-in updater (chrome://settings/help) and relaunch to apply, and roll the update through enterprise management (e.g., Google Admin/MDM) for fleet machines. As a compensating control until patched, disable or restrict the Web Bluetooth attack surface by setting the DefaultWebBluetoothGuardSetting enterprise policy to block (value 2), which prevents sites from requesting Bluetooth access at the cost of breaking legitimate Web Bluetooth applications; additionally advise users not to grant Bluetooth device access prompts and to avoid pairing with untrusted peripherals, since exploitation hinges on interaction with a malicious peripheral. Chromium-based browsers built on the same release line should also be updated once their vendors ship the corresponding fix.