CVE-2026-13879: Google Chrome Use After Free Vulnerability

CVE-2026-13879 Overview

CVE-2026-13879 is a use-after-free vulnerability [CWE-416] in the Bluetooth component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.47 on Windows, macOS, and Linux. An attacker on the same local network segment can exploit the issue through a malicious Bluetooth peripheral to read sensitive data from Chrome process memory. Google's Chromium team rates the security severity as Medium.

Critical Impact
A malicious Bluetooth peripheral on the adjacent network can trigger a use-after-free condition in Chrome, disclosing potentially sensitive information from process memory including credentials, session tokens, or browsing data.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome desktop builds on Apple macOS, Linux, and Microsoft Windows
Any Chromium-based application embedding the vulnerable Web Bluetooth stack

Discovery Timeline

2026-06-30 - CVE-2026-13879 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13879

Vulnerability Analysis

The vulnerability resides in Chrome's Bluetooth subsystem, which implements the Web Bluetooth API allowing web pages to communicate with nearby Bluetooth Low Energy (BLE) peripherals. A use-after-free condition occurs when Chrome continues to reference a memory object after that object has been freed. When a malicious peripheral triggers specific interaction sequences with the browser, Chrome dereferences a stale pointer during Bluetooth event handling.

The result is a read of memory that may already contain data from another allocation. This gives an attacker the ability to leak process memory contents back through the Bluetooth interface. According to the Chromium Issue Tracker entry, the flaw affects the pairing and characteristic-handling flow rather than requiring memory corruption for code execution.

Root Cause

The root cause is improper object lifetime management in the Bluetooth device event handlers [CWE-416]. When a Bluetooth peripheral disconnects or renegotiates during an active operation, the associated device object is released while pending callbacks still hold references to it. Subsequent access to the freed object reads stale heap memory, exposing whatever content the allocator has since placed at that address.

Attack Vector

Exploitation requires adjacency to the target on the local network segment, specifically Bluetooth radio range. The attacker operates a malicious peripheral advertising services that a Chrome-hosted web application will interact with via the Web Bluetooth API. User interaction is not required beyond the existing Web Bluetooth permission model. Because the confidentiality impact is high while integrity and availability are not affected, the flaw functions as an information disclosure primitive rather than a code execution bug.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-13879

Indicators of Compromise

Chrome browser processes reporting unexpected crashes or memory sanitizer alerts tied to the device::BluetoothDevice code path
Unusual pairing attempts from unknown Bluetooth peripherals near workstations running outdated Chrome builds
Endpoints running Chrome versions below 150.0.7871.47 that have Web Bluetooth enabled through enterprise policy

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 150.0.7871.47
Monitor Chrome crash telemetry and Windows Error Reporting entries for faults involving Bluetooth-related modules
Correlate Bluetooth pairing events from host logs with browser process activity to surface anomalous peripheral interactions

Monitoring Recommendations

Ingest Chrome update status and browser version data into your SIEM to identify unpatched endpoints
Track Web Bluetooth API usage through browser enterprise reporting policies where available
Alert on Bluetooth pairing events on corporate laptops in shared or public locations such as conference venues and open offices

How to Mitigate CVE-2026-13879

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Verify auto-update is functioning by checking chrome://settings/help and forcing a relaunch after the update installs
For managed fleets, push the patched build through your endpoint management platform and confirm compliance

Patch Information

Google addressed CVE-2026-13879 in the stable channel release documented in the Google Chrome Update Post. The fix ships in Chrome 150.0.7871.47 and later stable builds. Chromium-derived browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors integrate the upstream patch.

Workarounds

Disable the Web Bluetooth API through the DefaultWebBluetoothGuardSetting enterprise policy set to value 2 (block) until patching completes
Restrict Bluetooth radio use on endpoints that do not require it, either through OS-level controls or by disabling the hardware in firmware
Educate users to avoid pairing with unknown Bluetooth devices in public environments

bash

# Chrome enterprise policy to block Web Bluetooth on Windows via registry
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebBluetoothGuardSetting /t REG_DWORD /d 2 /f

# macOS equivalent via plist
defaults write com.google.Chrome DefaultWebBluetoothGuardSetting -int 2

# Linux managed policy JSON fragment (/etc/opt/chrome/policies/managed/bluetooth.json)
# {
#   "DefaultWebBluetoothGuardSetting": 2
# }