CVE Intelligence
Analysis AI-assisted

CVE-2026-9881: Google Chrome Bluetooth Use-After-Free Enabling Possible Sandbox Escape

CVE-2026-9881 is a use-after-free weakness (CWE-416) in the Bluetooth component of Google Chrome on Mac, described as fixed before 148.0.7778.216. According to the record, an attacker who convinces a user to install a malicious extension could potentially escape the browser sandbox. The record carries a critical score of 9, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9881 describes a use-after-free weakness (CWE-416) in the Bluetooth component of Google Chrome on Mac. The record states that exploitation depends on a user installing a malicious extension, after which a crafted extension could potentially perform a sandbox escape.

Impact

The record describes a potential sandbox escape. Scores from the CNA and CISA-ADP are both 9 (critical), with a vector that marks the scope as changed and high impact to confidentiality, integrity and availability. The SSVC technical impact is listed as total.

Affected products and versions

  • Google Chrome on Mac, described as before 148.0.7778.216.
  • The record contains a second affected entry that is internally contradictory (a range starting at 148.0.7778.216 and ending before the same version), so the exact affected range is unknown.
  • No structured list of fixed versions is present. The version 148.0.7778.216 is the fixed version implied by the description and the release notes reference.

Exploitation status

  • The vulnerability is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC lists exploitation as none and automatable as no.
  • The EPSS probability is 0.00283 with a percentile of 0.19794, as recorded.

Remediation and mitigation

  • Update Google Chrome on macOS to 148.0.7778.216 or later, as indicated by the vendor release notes in Chrome Releases.
  • Review installed extensions and remove those that are unnecessary or from untrusted sources.
  • Where extension installation is managed centrally, restrict installation to approved extensions.

Detection guidance

  • Inventory Chrome versions on macOS endpoints and flag builds older than 148.0.7778.216.
  • Monitor for newly installed browser extensions that fall outside approved lists.
  • Refer to the Chromium issue tracker entry for the upstream report, which is marked as requiring permissions to view.

Limitations of the available information

  • The record contains no technical analysis, proof of concept or exploitation details, and this analysis does not add any.
  • The affected version range is contradictory and no structured fixed-version field is provided.
  • The vector marks user interaction as not required, while the description requires the user to install a malicious extension. The reason for this difference is unknown.
  • The EPSS date in the record is later than the publication date; treat the EPSS values with caution.
  • The content of the Chromium issue tracker entry was not available for review.

Frequently asked questions

Does this CVE affect Chrome on Windows or Linux?

The record names Google Chrome on Mac only. Whether other platforms are affected is unknown from the sources in the record.

Is this vulnerability being exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Google Chrome on macOS to 148.0.7778.216 or later, review installed extensions, and restrict extension installation where possible.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.