CVE-2026-13785: Google Chrome for Mac: Bluetooth use-after-free enabling possible sandbox escape
CVE-2026-13785 is a use-after-free flaw in the Bluetooth component of Google Chrome on macOS, classified as CWE-416. The record says a remote attacker could potentially escape the sandbox through a crafted HTML page if a user is persuaded to perform specific UI gestures. NVD assigns CVSS 3.1 9.6, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-13785 is a use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS, classified as CWE-416. According to the record, a remote attacker who convinces a user to perform specific UI gestures could potentially escape the browser sandbox through a crafted HTML page. The vendor rates the Chromium security severity as Critical.
Impact
- The record describes a potential sandbox escape, which would move execution beyond the browser's restricted process boundary.
- NVD scores the issue 9.6 under CVSS 3.1, with network attack vector, low complexity, no privileges required, user interaction required, scope change and high confidentiality, integrity and availability impact.
- Real-world impact depends on the attack chain and on the user actually performing the required gestures, which the record does not detail.
Affected products and versions
- Google Chrome on Mac prior to 150.0.7871.47.
- The record does not list other platforms, channels or builds separately.
- Because the affected range ends before 150.0.7871.47, that build and later are outside the stated range (inference).
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation appears in the sources consulted.
- The EPSS probability is 0.00319 with a percentile of 0.23123, as recorded by FIRST.
Remediation and mitigation
- Update Google Chrome on macOS to version 150.0.7871.47 or later, following the vendor advisory in the stable channel update.
- Confirm that automatic updates are working and, in managed environments, enforce update policies so that the fixed build is deployed promptly.
- Reduce exposure by limiting browsing of untrusted web content on systems that have not yet been updated.
- The record does not describe a vendor-specified workaround, so none is reported here.
Detection guidance
- Inventory Chrome versions across macOS endpoints and flag any installation older than 150.0.7871.47.
- Review endpoint telemetry for unexpected browser crashes or anomalous child process activity originating from Chrome, as a high-level indicator to investigate.
- Track the vendor issue reference for any updates to the record.
Limitations of the available information
- The record contains no fixed-version field entry, so the fix is established only through the affected range and the vendor advisory.
- The record gives no technical details about the vulnerable code path, and no proof-of-concept information is provided here.
- The title was not supplied in the source record and has been written for this analysis.
- The vendor issue tracker entry is marked as permissions required, so its contents could not be relied upon beyond the record.
Frequently asked questions
Is CVE-2026-13785 being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.
Which Chrome version fixes this issue?
The affected range is prior to 150.0.7871.47, so updating to that version or later addresses the stated range, as described in the vendor advisory.
Does the attack require user action?
Yes. The record states the attacker must convince a user to perform specific UI gestures while visiting a crafted HTML page.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.