CVE-2026-79001: Google Chrome Bluetooth Info Leak Flaw

CVE-2026-79001 Overview

CVE-2026-79001 is an information disclosure vulnerability in the Bluetooth component of Google Chrome on macOS prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can leverage social engineering to extract sensitive information via a crafted HTML page. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium classifies the internal security severity as Low, and NVD scores the issue at CVSS 5.3.

Critical Impact
Attackers combining a compromised renderer with user interaction on a crafted page can leak sensitive Bluetooth-related data from Chrome on macOS.

Affected Products

Google Chrome on macOS prior to 152.0.7977.65
Apple macOS (host platform for the affected Chrome builds)
Chromium-based browsers on macOS sharing the vulnerable Bluetooth code path

Discovery Timeline

2026-08-25 - CVE-2026-79001 published to NVD
2026-08-26 - Last updated in NVD database
2026-08 - Google releases Chrome Stable channel update addressing the issue via the Stable Channel Update for Desktop

Technical Details for CVE-2026-79001

Vulnerability Analysis

The vulnerability resides in Chrome's Bluetooth implementation on macOS. An attacker must first compromise the renderer process, typically by chaining a separate memory-corruption or logic bug. From that foothold, the attacker uses a crafted HTML page and social engineering to coax the user into an interaction that surfaces sensitive information through the Bluetooth stack.

Because the flaw requires both a pre-existing renderer compromise and user interaction, exploitation complexity is high. However, the outcome is meaningful: unauthorized disclosure of data that would otherwise remain isolated by Chrome's site and process boundaries. The EPSS score is 0.311%, and no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is insufficient isolation between the compromised renderer and sensitive Bluetooth data handled by Chrome on macOS, mapped to CWE-200. The Bluetooth subsystem returns or exposes data that a hostile renderer can observe when combined with user-driven actions on a malicious page. See Chromium Issue Tracker #500484520 for internal tracking.

Attack Vector

Exploitation follows a multi-stage chain. The attacker delivers a crafted HTML page over the network, which requires user interaction such as clicking a Bluetooth permission prompt or accepting a device pairing dialog. With a compromised renderer already running, the attacker uses these interactions to observe Bluetooth data flowing through the browser process boundary.

No verified public exploit code is available. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-79001

Indicators of Compromise

Chrome renderer processes on macOS spawning unexpected child processes or exhibiting anomalous memory patterns consistent with prior compromise.
Unusual Bluetooth permission prompts or device pairing activity initiated from web content.
Outbound connections from Chrome to attacker-controlled domains immediately after Bluetooth API usage.

Detection Strategies

Inventory Chrome versions across macOS endpoints and flag any host running a build older than 152.0.7977.65.
Correlate chrome.bluetooth Web API usage with process-level anomalies in the renderer.
Hunt for suspicious HTML content served with Bluetooth-related JavaScript from newly registered or low-reputation domains.

Monitoring Recommendations

Enable enterprise browser telemetry to log Chrome version, extension state, and permission grants.
Monitor macOS IOBluetooth framework calls originating from browser processes for baseline deviation.
Alert on renderer process crashes or exploitation-indicative signals preceding Bluetooth permission prompts.

How to Mitigate CVE-2026-79001

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later.
Verify enterprise auto-update policies are enabled and not blocked by managed configuration profiles.
Audit user-granted Bluetooth permissions in Chrome and revoke access for untrusted origins.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Stable Channel Update for Desktop. Administrators should confirm deployment of Chrome 152.0.7977.65 or newer on macOS. Chromium-based browsers should be updated to a build that incorporates the corresponding upstream fix referenced in Chromium Issue Tracker #500484520.

Workarounds

Disable the Web Bluetooth API via enterprise policy where business use cases do not require it.
Train users to reject unexpected Bluetooth pairing or permission prompts originating from web pages.
Restrict Bluetooth access at the macOS level using configuration profiles for high-risk user groups.

bash

# Configuration example: disable Web Bluetooth via Chrome enterprise policy on macOS
defaults write com.google.Chrome DefaultWebBluetoothGuardSetting -int 2