CVE-2026-13878: Google Chrome Bluetooth Use-After-Free Sandbox Escape (Mac)
CVE-2026-13878 is a use-after-free flaw in the Bluetooth component of Google Chrome on Mac, described as allowing a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The record lists a CVSS score of 9.6, and the affected range indicates that versions before 150.0.7871.47 are impacted. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
CVE-2026-13878 is a use-after-free weakness (CWE-416) in the Bluetooth component of Google Chrome on Mac. According to the record, the flaw could let a remote attacker who had already compromised the renderer process attempt a sandbox escape through a crafted HTML page. The vendor-side Chromium severity is rated Medium.
Impact
- The described consequence is a potential sandbox escape, which would extend an attacker's reach beyond the browser's renderer isolation.
- The CVSS score of 9.6 is reported by both the CNA entry and the CISA-ADP entry, with high confidentiality, integrity and availability impact and a scope change.
- The record's severity label of critical follows from that CVSS score, while the Chromium internal rating is Medium.
Affected products and versions
- Google Chrome on Mac prior to 150.0.7871.47 is listed as affected.
- The record also contains a second affected range that is internally empty, so the exact boundaries should be confirmed against the vendor release notes.
- No fixed-version field is populated in the record; the update to 150.0.7871.47 is referenced as the stable channel release that addresses the issue.
Exploitation status
- The CVE is not listed in CISA KEV in the record, so no active exploitation can be stated from that source.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability is 0.00306 (percentile 0.21657), and the SSVC exploitation field is none with automatable set to no.
Remediation and mitigation
- Update Google Chrome on macOS to version 150.0.7871.47 or later, using the stable channel release referenced by the vendor.
- Keep automatic updates enabled so that browser security fixes are applied promptly.
- Until updates are applied, limit browsing of untrusted sites and be cautious with links from unknown sources.
- Review whether Bluetooth features in the browser are needed on sensitive systems, as a defence-in-depth measure.
Detection guidance
- Inventory Chrome versions across macOS endpoints and flag any installation older than 150.0.7871.47.
- Monitor for unexpected renderer crashes or abnormal browser helper process activity, which may indicate attempted exploitation attempts; correlate with browsing activity where policy allows.
- Confirm update status through centralised patch management or endpoint management tooling.
Limitations of the available information
- The record does not provide technical details about the vulnerable code path, and the Chromium issue tracker entry is marked as requiring permissions.
- The prerequisites beyond the renderer compromise are not described in detail.
- The inconsistent affected range entry means the exact version boundary should be verified against the vendor advisory.
- No proof-of-concept or exploitation evidence is included in the sources consulted.
Frequently asked questions
What is CVE-2026-13878?
It is a use-after-free vulnerability in the Bluetooth component of Google Chrome on Mac that could allow a sandbox escape when combined with a renderer compromise.
Which version fixes this issue?
The record indicates versions prior to 150.0.7871.47 are affected, and the referenced stable channel update is the vendor release to apply; confirm the exact boundary in the vendor notes.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.