CVE-2026-11641: Critical Use-After-Free in Chrome Bluetooth on Windows

Technical summary

CVE-2026-11641 is a use-after-free vulnerability (CWE-416) in Chrome's Bluetooth subsystem. When the Bluetooth module processes certain sequences of operations after freeing memory, subsequent interactions with that freed memory can lead to memory corruption. An attacker can craft HTML content that, combined with targeted UI gestures from the user, causes the freed memory to be reallocated and controlled by malicious code, resulting in arbitrary code execution within the Chrome process context on Windows systems running versions prior to 149.0.7827.103.

Business impact

This vulnerability poses a significant risk to organizations where employees browse untrusted content or interact with potentially malicious websites. Successful exploitation could allow attackers to steal sensitive data from browser memory, install malware, compromise email credentials stored in the browser, or pivot to internal systems. The requirement for user interaction somewhat limits mass exploitation, but phishing campaigns or watering-hole attacks could be effective delivery vectors. Organizations should prioritize patching exposed systems to prevent data theft and lateral movement.

Affected systems

Google Chrome on Microsoft Windows versions prior to 149.0.7827.103 are vulnerable. This includes all stable, beta, and earlier release channels on Windows. Users on macOS and Linux are not affected by this specific Bluetooth-related flaw. Enterprise deployments using managed Chrome instances and standard Windows environments are equally at risk if unpatched.

Exploitability

The vulnerability requires convincing a user to visit a malicious website and perform specific UI gestures (such as enabling Bluetooth, interacting with Bluetooth dialogs, or triggering specific browser actions). This is not an unauthenticated network-based wormable flaw. However, the bar for user interaction is moderate—phishing emails with urgent-looking links or compromised websites could successfully deliver the exploit to unsuspecting users. The Chromium security team classified this as Critical severity, reflecting the severity of the impact if triggered, even though exploitation is not automatic.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. This patch addresses the underlying memory management issue in the Bluetooth implementation. For enterprise environments, configure automatic updates or deploy the patch through your standard patch management process. Verify the update has been applied by checking Chrome's version in Settings > About Chrome, which will also automatically check for and install any pending updates.

Patch guidance

Chrome version 149.0.7827.103 and all subsequent versions contain the fix. Users can enable automatic updates (the default setting) to receive the patch without manual intervention. Enterprise administrators should verify patch deployment using your endpoint management solution and confirm that Chrome instances have updated successfully. Check the Chromium release notes for any compatibility considerations, though this memory fix should not affect normal browsing.

Detection guidance

Monitor for crashed Chrome processes, particularly those involving Bluetooth functionality, as failed exploitation attempts may leave detectable artifacts. Endpoint detection and response (EDR) tools should flag processes spawning suspicious child processes from Chrome or unexpected code execution within browser memory. Web proxy logs showing visits to known malicious domains should be correlated with subsequent Chrome crashes or suspicious behavior on affected systems. However, successful exploitation may be difficult to detect if the attacker maintains stealth; focus on prevention through patching.

Why prioritize this

Although this requires user interaction, the combination of high impact (arbitrary code execution in browser context), the prevalence of Windows and Chrome in enterprises, the ease of delivering a phishing link to trigger user interaction, and the moderate complexity of exploitation make this a high-priority patch. The Chromium Critical rating and high CVSS score reflect the severity if exploited. Organizations should treat this as urgent and allocate resources to rapid patch deployment.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality, integrity, and availability impact (arbitrary code execution) balanced against the requirement for user interaction and moderately complex attack conditions. The score appropriately captures that while the impact is severe, the attack is not network-automatic. The Chromium Critical designation emphasizes the practical severity and real-world risk, which aligns with the HIGH CVSS rating.

Frequently asked questions