CVE-2026-17737: Chrome Android Bluetooth UAF Vulnerability

CVE-2026-17737 Overview

CVE-2026-17737 is a use-after-free vulnerability [CWE-416] in the Bluetooth component of Google Chrome on Android. The flaw affects versions of Chrome prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium security team rated this issue Medium severity.

Sandbox escapes in browsers are consequential because they allow attackers to move from limited renderer privileges to broader access on the host device. The vulnerability requires prior renderer compromise, which is typically achieved by chaining a separate renderer bug.

Critical Impact
Successful exploitation permits sandbox escape from a compromised Chrome renderer process on Android, enabling attackers to break out of the browser's isolation boundary.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that inherit the vulnerable Bluetooth code path
Applications embedding vulnerable Chromium builds with Web Bluetooth support enabled

Discovery Timeline

2026-07-30 - CVE-2026-17737 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17737

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Bluetooth implementation on Android. Use-after-free bugs occur when a program continues to reference memory after it has been freed. When the freed memory is reallocated and populated with attacker-controlled data, subsequent access to the dangling pointer can lead to controlled memory corruption.

In this case, the flawed code path resides in the browser process code that services Web Bluetooth API requests originating from the renderer. Because the browser process operates outside the renderer sandbox, memory corruption there can be leveraged to execute logic beyond the renderer's confinement boundary.

Root Cause

The root cause is improper object lifetime management in the Bluetooth subsystem. A Bluetooth-related object is released while a reference to it remains reachable through the IPC boundary between the renderer and browser processes. Additional technical details are tracked in Chromium Issue #498000415.

Attack Vector

Exploitation is not a single-shot remote attack. It requires that an attacker first compromise the Chrome renderer process, typically by chaining a separate renderer-side vulnerability triggered from a crafted HTML page. Once the renderer is under attacker control, the malicious page issues Web Bluetooth IPC messages designed to trigger the freed-object reuse in the browser process, resulting in a sandbox escape on Android.

Refer to the Google Chrome Desktop Update advisory for the vendor's disclosure of the fixed version.

Detection Methods for CVE-2026-17737

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72 accessing untrusted web content
Unexpected Chrome browser process crashes on Android correlated with Web Bluetooth activity
Anomalous child processes or file writes originating from the Chrome browser process on Android

Detection Strategies

Inventory installed Chrome versions across managed Android fleets and flag builds below 151.0.7922.72
Monitor mobile endpoint telemetry for post-exploitation behavior such as unexpected privilege changes or persistence attempts following browser activity
Correlate crash reports and Chrome stability signals with browsing sessions that used Web Bluetooth

Monitoring Recommendations

Track Chrome update compliance through mobile device management (MDM) reporting
Alert on Android devices that fail to receive Chrome updates within the vendor's patch window
Review Web Bluetooth site permissions granted on managed devices and remove unnecessary grants

How to Mitigate CVE-2026-17737

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce Chrome auto-update policies through MDM to ensure timely patch deployment
Restrict Web Bluetooth permissions on managed Android devices where the capability is not required

Patch Information

Google released the fix in Chrome 151.0.7922.72 for Android. Users should install this version or later. The associated tracker entry is Chromium Issue #498000415, and the release announcement is available at the Chrome Releases blog.

Workarounds

Disable Web Bluetooth access via enterprise policy where feasible until patching is complete
Deny Bluetooth permission requests from untrusted websites in Chrome site settings
Limit browsing on unpatched devices to trusted sites and avoid granting Bluetooth site permissions

bash

# Verify installed Chrome version on Android via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output on a patched device:
# versionName=151.0.7922.72