CVE-2026-13035: Chrome Bluetooth Use-After-Free RCE on macOS – Patch Guidance

Technical summary

CVE-2026-13035 is a use-after-free (CWE-416) vulnerability in Chrome's Bluetooth stack on macOS. The defect allows memory that has been freed to be accessed again, leading to memory corruption. A remote attacker can craft a malicious Bluetooth peripheral to trigger this condition when a user connects to it. Successful exploitation results in arbitrary code execution in the Chrome process context. The vulnerability affects Chrome versions prior to 149.0.7827.197 on macOS systems.

Business impact

Compromise of Chrome on macOS exposes users to data theft, credential harvesting, and malware installation. For organizations with BYOD policies or employees using personal macOS devices for work, this vulnerability creates a pathway to corporate network access and lateral movement. The requirement for user interaction (connecting to a Bluetooth peripheral) raises the bar slightly, but social engineering and proximity attacks make exploitation realistic in targeted scenarios. Systems handling sensitive data or identity verification should prioritize patching.

Affected systems

Google Chrome on Apple macOS is the affected platform. All Chrome versions prior to 149.0.7827.197 are vulnerable. The vulnerability does not affect Chrome on Windows or Linux, nor does it affect Safari or other browsers on macOS, but users running outdated Chrome builds remain at risk. macOS itself is mentioned in vendor metadata but the vulnerability is specific to Chrome's Bluetooth handling, not the underlying OS.

Exploitability

The attack requires proximity or social engineering to convince a user to connect to a malicious Bluetooth device. No authentication or special privileges are required from the attacker. Once triggered, the use-after-free can be reliably exploited to achieve code execution. CVSS score of 8.8 (High) reflects the combination of network accessibility, low complexity, and user interaction as the sole defense. In scenarios involving public Bluetooth networks, conferences, or targeted environments, exploit likelihood is elevated.

Remediation

Update Chrome to version 149.0.7827.197 or later on all macOS systems. Organizations should enable automatic Chrome updates or enforce a forced update policy through MDM/device management tools. Users should verify their Chrome version at chrome://settings/help and restart the browser if an update is available. As an interim measure, disabling Bluetooth on systems that do not require it reduces exposure.

Patch guidance

Deploy Chrome version 149.0.7827.197 or newer via your organization's patch management system. For macOS deployments, verify compatibility with your operating system version before rollout. Enable automatic updates in Chrome settings (chrome://settings) to prevent version drift. Test in a non-production environment to confirm no compatibility issues with extensions or web applications your organization relies on. Communicate the update urgency to users, emphasizing the RCE risk.

Detection guidance

Monitor Chrome process execution for abnormal Bluetooth API calls or unexpected child processes. On macOS, check system logs for repeated Bluetooth connection failures or permission prompts from Chrome. Network monitoring can detect unusual outbound connections from Chrome processes post-exploitation. EDR/XDR solutions should flag Chrome crashes or memory violations during Bluetooth operations. Compare Chrome versions across the fleet using inventory tools and alert on instances running versions older than 149.0.7827.197.

Why prioritize this

CVE-2026-13035 warrants high priority due to its remote code execution impact, high CVSS score (8.8), and broad user base exposure through Chrome. The Chromium project rated this as High severity, reflecting its significance. Although user interaction is required, the barrier to exploitation remains relatively low. Organizations with macOS-heavy environments, security-sensitive roles, or high-value targets should patch within 48-72 hours.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network vector—attack can be initiated remotely without direct system access; (2) Low attack complexity—no special conditions or knowledge required; (3) No privileges needed; (4) User interaction required, which is the primary mitigating control; (5) Full impact across confidentiality, integrity, and availability once code executes. This combination places the vulnerability in the High severity tier, justifying urgent remediation.

Frequently asked questions