CVE-2026-11699: Google Chrome Use After Free Vulnerability

CVE-2026-11699 Overview

CVE-2026-11699 is a use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS. The flaw affects Chrome versions prior to 149.0.7827.103. A remote attacker can trigger heap corruption by enticing a victim to load a crafted HTML page. Google classifies the Chromium security severity as High.

The vulnerability is tracked under CWE-416: Use After Free. Exploitation requires user interaction but no privileges, and the attack originates over the network.

Critical Impact
Successful exploitation can lead to heap corruption and potential arbitrary code execution within the Chrome renderer process on macOS endpoints.

Affected Products

Google Chrome on macOS prior to 149.0.7827.103
Apple macOS systems running affected Chrome builds
Chromium-based browsers sharing the same Bluetooth code path

Discovery Timeline

2026-06-09 - CVE-2026-11699 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11699

Vulnerability Analysis

The defect resides in Chrome's Bluetooth implementation on macOS. A use-after-free condition occurs when the browser dereferences a heap object after it has already been released. An attacker who controls a crafted HTML page can drive the Web Bluetooth API into a state where stale pointers are reused, corrupting the heap.

Heap corruption in the renderer often serves as the first stage in a browser exploit chain. Attackers typically pair such primitives with a sandbox escape to achieve remote code execution on the host. The advisory from Google indicates the issue is exploitable via a single crafted page, with user interaction limited to visiting attacker-controlled content.

EPSS data places the current exploitation probability at 0.068% (percentile 21.037), reflecting low observed activity at the time of disclosure.

Root Cause

The root cause is improper object lifetime management within the Bluetooth subsystem. A reference to a heap-allocated Bluetooth object persists after the object is freed. Subsequent operations dereference the dangling pointer, allowing an attacker to influence the contents of the reused memory region [CWE-416].

Attack Vector

Exploitation occurs over the network through a crafted HTML page. The victim must navigate to the malicious page or open it via an embedded frame. No authentication is required. Once the page loads, JavaScript on the page interacts with Web Bluetooth interfaces to trigger the freed-object reuse and corrupt the heap.

No public proof-of-concept or exploit code is referenced in the advisory. Technical details are tracked in the Chromium Issue Tracker entry.

Detection Methods for CVE-2026-11699

Indicators of Compromise

Chrome renderer process crashes on macOS hosts referencing Bluetooth-related stack frames
Outbound connections from macOS endpoints to unfamiliar domains immediately preceding a renderer crash
Unexpected child processes spawned from Google Chrome Helper (Renderer) on macOS

Detection Strategies

Inventory installed Chrome versions across macOS fleets and flag any build below 149.0.7827.103
Monitor browser telemetry for repeated tab or renderer crashes correlated with Web Bluetooth API usage
Correlate web proxy logs for users visiting low-reputation sites followed by Chrome crash events

Monitoring Recommendations

Enable crash reporting and centralize Chrome crash dumps for review by the security team
Track Chrome update compliance through MDM tooling such as Jamf or Intune for macOS
Alert on anomalous process trees originating from Chrome Helper processes on macOS

How to Mitigate CVE-2026-11699

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 149.0.7827.103 or later
Force a browser restart after deployment to ensure the patched binary is loaded
Validate version compliance through endpoint management tooling and audit reports

Patch Information

Google addressed the issue in the Stable channel update detailed in the Google Chrome Update Announcement. Administrators should deploy Chrome 149.0.7827.103 or later on macOS to remediate the use-after-free condition.

Workarounds

Disable the Web Bluetooth feature via enterprise policy DefaultWebBluetoothGuardSetting set to block until patching is complete
Restrict navigation to trusted domains using browser policy or web filtering controls
Advise users to avoid pairing Bluetooth devices from web pages on unpatched macOS endpoints

bash

# Example macOS Chrome enterprise policy to block Web Bluetooth
defaults write com.google.Chrome DefaultWebBluetoothGuardSetting -int 2