CVE-2026-79091 Overview
CVE-2026-79091 is a use-after-free vulnerability [CWE-416] in the Bluetooth component of Google Chrome on macOS. Versions prior to 152.0.7977.65 are affected. A remote attacker can leverage social engineering to lure a user to a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. The flaw carries a scope-changed impact because the attacker escapes the renderer sandbox boundary. Google classifies the Chromium security severity as Medium, while NVD scores it at the higher tier due to sandbox escape potential.
Critical Impact
Arbitrary code execution outside the Chrome sandbox on macOS following a single user interaction with a crafted HTML page.
Affected Products
- Google Chrome on macOS prior to 152.0.7977.65
- Apple macOS (host platform)
- Chromium-based browsers sharing the vulnerable Bluetooth code path
Discovery Timeline
- 2026-08-25 - CVE-2026-79091 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79091
Vulnerability Analysis
The vulnerability resides in Chrome's Web Bluetooth implementation on macOS. The bug is a use-after-free condition, where memory referenced by an internal pointer is freed but subsequently accessed. An attacker who convinces a user to open a crafted HTML page can trigger the dangling reference. Because the flaw affects Bluetooth handling that interacts with privileged browser components, exploitation leads to code execution outside the renderer sandbox. This is significant because sandbox escapes remove a key Chrome exploitation barrier. The scope change reflected in the CVSS vector indicates the attacker crosses a security boundary from web content to host-level browser privileges.
Root Cause
The root cause is improper object lifetime management in the Bluetooth subsystem. A referenced object is released while another code path still holds a pointer to it. Reuse of that stale pointer during Bluetooth event dispatch produces the use-after-free condition. This class of bug is tracked under CWE-416.
Attack Vector
Exploitation requires the victim to visit a malicious HTML page and interact with it, typically to authorize Web Bluetooth access. The attacker crafts JavaScript that manipulates Bluetooth device objects in a specific sequence to trigger the freed-memory reuse. No prior authentication is required, and the attack is delivered over the network. See the Chromium Issue Tracker #523557855 for tracking details.
No verified public exploit code is available for this issue. The vulnerability mechanism should be understood through the vendor references rather than reproduced.
Detection Methods for CVE-2026-79091
Indicators of Compromise
- Chrome browser processes on macOS spawning unexpected child processes or writing to unusual filesystem paths after visiting untrusted web content.
- Crash reports or renderer terminations referencing the Bluetooth service or device::BluetoothAdapter code paths.
- Outbound connections from Chrome helper processes to attacker-controlled infrastructure following a Web Bluetooth permission prompt.
Detection Strategies
- Inventory macOS endpoints and identify Chrome installations reporting a version below 152.0.7977.65.
- Monitor for anomalous process lineage descending from Google Chrome Helper on macOS.
- Correlate browser telemetry with Web Bluetooth API usage events on sensitive endpoints.
Monitoring Recommendations
- Enable browser crash and exception telemetry forwarding to a central logging system for review.
- Track code-signing anomalies for binaries executed from Chrome cache or temporary directories.
- Alert on new persistence mechanisms (LaunchAgents, LaunchDaemons) created shortly after browser activity.
How to Mitigate CVE-2026-79091
Immediate Actions Required
- Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later.
- Restart Chrome after updating to ensure the patched binary is active for all users.
- Audit managed browser fleets to confirm auto-update is enabled and functioning.
Patch Information
Google addressed the vulnerability in Chrome Stable channel version 152.0.7977.65 for macOS. Details are available in the Google Chrome Stable Update advisory.
Workarounds
- Disable Web Bluetooth through enterprise policy by setting DefaultWebBluetoothGuardSetting to block access until patching completes.
- Restrict Chrome usage to trusted sites via URL allowlists on high-value macOS endpoints.
- Educate users to decline Bluetooth permission prompts from untrusted web pages.
# Configuration example: disable Web Bluetooth via Chrome enterprise policy on macOS
defaults write com.google.Chrome DefaultWebBluetoothGuardSetting -int 2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
