CVE-2026-11635 Overview
CVE-2026-11635 is a use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS. The flaw affects versions of Google Chrome prior to 149.0.7827.103. An attacker who has already compromised the renderer process can leverage this issue to potentially perform a sandbox escape through a crafted HTML page. Google's Chromium project rated the security severity as Critical, while the National Vulnerability Database assigned a HIGH rating. The vulnerability is tracked as [CWE-416] and was patched in the stable channel update for desktop.
Critical Impact
A successful exploit chains with a prior renderer compromise to escape the Chrome sandbox on macOS, granting attackers code execution outside the browser's restricted process boundary.
Affected Products
- Google Chrome on macOS versions prior to 149.0.7827.103
- Apple macOS systems running vulnerable Chrome builds
- Chromium-based deployments incorporating the affected Bluetooth code path
Discovery Timeline
- 2026-06-09 - CVE-2026-11635 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11635
Vulnerability Analysis
The vulnerability is a use-after-free condition in Chrome's Bluetooth implementation on macOS. Use-after-free defects occur when a program continues to reference memory after it has been released. An attacker who controls the freed object's memory region can manipulate program flow when the dangling pointer is dereferenced. In this case, the bug lives behind the Bluetooth Web API surface exposed to the renderer process. Exploitation requires the attacker to first compromise the renderer, then trigger the Bluetooth code path through a crafted HTML page. The result is a sandbox escape, moving execution from the restricted renderer to a higher-privileged browser process context.
Root Cause
The root cause is improper object lifetime management within the Bluetooth subsystem on the macOS port of Chrome. A Bluetooth-related object is freed while another code path retains a reference to it. When that reference is later used, the underlying memory may have been reallocated to attacker-controlled data, enabling arbitrary read, write, or control-flow primitives. The defect is classified under [CWE-416] Use After Free.
Attack Vector
Exploitation requires network-delivered content and user interaction, such as visiting a malicious or compromised web page. The attacker must already hold code execution in the renderer process, typically achieved by chaining a separate renderer vulnerability. The crafted HTML page then drives Bluetooth API interactions that trigger the use-after-free. Successful exploitation produces a scope change, breaking the sandbox boundary that normally contains renderer-resident attacker code. Refer to the Chromium Issue Tracker #516987814 for technical details once access restrictions are lifted.
Detection Methods for CVE-2026-11635
Indicators of Compromise
- Chrome browser processes on macOS spawning unexpected child processes or writing to unusual file system locations following a browsing session.
- Crash reports referencing the Bluetooth component in Chrome versions earlier than 149.0.7827.103.
- Outbound connections from Chrome helper processes to attacker-controlled infrastructure after rendering untrusted HTML.
Detection Strategies
- Inventory macOS endpoints to identify Chrome installations below 149.0.7827.103 and flag them for remediation.
- Monitor for renderer process anomalies, including unexpected memory access patterns or repeated crashes within Bluetooth code paths.
- Correlate browsing telemetry with process lineage to identify sandbox escape attempts originating from Chrome helper processes.
Monitoring Recommendations
- Enable endpoint telemetry for process creation, code injection, and dynamic library loads originating from Chrome on macOS.
- Collect and centralize Chrome crash dumps to identify clusters of Bluetooth-related faults that may indicate exploitation attempts.
- Track Chrome version distribution across the fleet and alert when versions fall behind the patched release.
How to Mitigate CVE-2026-11635
Immediate Actions Required
- Update Google Chrome on all macOS endpoints to version 149.0.7827.103 or later.
- Force-restart Chrome after patching to ensure the vulnerable code is unloaded from memory.
- Audit managed Chrome deployments for auto-update policies and confirm they are enforcing the stable channel.
Patch Information
Google addressed the issue in the Chrome stable channel update for desktop. The fix is included in Chrome 149.0.7827.103 and later on macOS. See the Google Chrome Stable Update for release notes and rollout details.
Workarounds
- Disable the Web Bluetooth API through enterprise policy by setting DefaultWebBluetoothGuardSetting to block until patching is complete.
- Restrict Chrome usage on macOS to trusted internal sites via site isolation and URL allowlists where operationally feasible.
- Apply browser hardening baselines that disable unused experimental web platform features exposing Bluetooth functionality.
# Configuration example: disable Web Bluetooth via Chrome enterprise policy on macOS
defaults write com.google.Chrome DefaultWebBluetoothGuardSetting -int 2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
