CVE-2026-13879: Chrome Bluetooth Use-After-Free Memory Disclosure Vulnerability

Technical summary

A use-after-free condition exists in the Bluetooth subsystem of Google Chrome prior to 150.0.7871.47. The vulnerability (CWE-416) permits local network attackers without authentication or user interaction to access sensitive information from Chrome's process memory via a malicious Bluetooth peripheral. The attack leverages the browser's Bluetooth device handling code path, where a freed memory region is accessed after deallocation, potentially exposing cached credentials, session tokens, or other in-memory data. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects the adjacent-network requirement, low attack complexity, high confidentiality impact, and no integrity or availability impact.

Business impact

Organizations and individuals using Chrome face risk of credential and sensitive data exfiltration if they operate on networks where attackers can introduce malicious Bluetooth devices. The impact is confined to information disclosure—no data modification or system compromise occurs. For enterprises with strict data classification policies or those handling regulated information, this presents a compliance and confidentiality concern. Consumer impact is lower unless devices are frequently used on public or untrusted wireless networks. The Medium severity rating reflects a contained threat model; this is not a widespread remote exploit vector.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 150.0.7871.47. The underlying Bluetooth stack implementations on these platforms may exhibit different exposure levels, but all Chrome browsers with vulnerable versions are affected. Users should verify their current Chrome version against the patch threshold provided by Google. Other products listed (Windows, macOS, Linux kernel) may share Bluetooth subsystem code paths, but the primary attack surface is Chrome's Bluetooth interface layer.

Exploitability

Exploitation requires proximity to the target system (adjacent network segment) and the ability to present a malicious Bluetooth peripheral. No user interaction or special privileges are required once the attacker is positioned. The low attack complexity suggests exploitation is straightforward given network access. This is not a remote code execution vector and does not enable lateral movement. Exploitability is practical but limited to scenarios where an attacker can control local Bluetooth peripherals or intercept Bluetooth communications. Real-world abuse is expected to be targeted rather than mass-scale.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Google recommends immediate patching for all users. Verify the patch deployment through Chrome Settings > About > Google Chrome, which triggers automatic update checks. Organizations should monitor deployment across managed endpoints. As a interim control, restrict Bluetooth connectivity to trusted devices and disable Bluetooth on systems where it is not required. Disabling Bluetooth in Chrome settings (chrome://settings/system) may further reduce attack surface pending patching.

Patch guidance

Google released Chrome 150.0.7871.47 and subsequent versions with a fix for the use-after-free condition. Verify the exact patch build number through your browser's About page or through Google's release notes. Automated update mechanisms in Chrome should deliver the patch within hours of release; manual updates can be forced by navigating to Settings > About > Google Chrome and restarting the browser. Organizations using Chrome Enterprise should deploy the fix via policy management tools. Test patch deployment in non-production environments first to confirm Bluetooth functionality and compatibility with internal services or extensions that depend on Bluetooth APIs.

Detection guidance

Monitor for unusual Bluetooth device connections originating from unrecognized or suspicious sources on user endpoints. Capture Chrome process memory dumps or enable detailed Bluetooth event logging if your security tools support it. Look for unexpected memory access patterns in Chrome's Bluetooth handling code—most modern EDR solutions can flag abnormal process behavior. Note that this vulnerability does not generate obvious indicators like network traffic or file modifications; detection relies on behavioral analysis or Bluetooth connection logs. Enable Chrome security event logging and correlate with Bluetooth peripheral enumeration on the host to identify anomalous device pairings during the attack window.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. The CVSS 6.5 Medium score and absence of KEV listing indicate it is not currently exploited in the wild at scale. However, the low barriers to exploitation for attacker proximity and high confidentiality impact justify elevated priority in security roadmaps. Organizations handling sensitive data should prioritize patching before vulnerabilities move to KEV. The confined attack surface (local Bluetooth) and lack of remote vector reduce business risk compared to network-exploitable flaws, permitting a structured patching schedule rather than emergency response.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: AV:A (adjacent network required, eliminating remote exploit scenarios), AC:L (exploitation is straightforward once proximity is achieved), PR:N/UI:N (no credentials or user action needed), C:H (high confidentiality impact—memory disclosure), and I:N/A:N (no integrity or availability compromise). This score appropriately penalizes the local network requirement while rewarding the unguarded information access. The Medium severity is correct; this is a focused data leakage threat, not a systemic compromise vector.

Frequently asked questions