A use‑after‑free flaw in the Bluetooth stack of Google Chrome prior to version 154.0.8037.92 enables an attacker to trigger arbitrary code execution outside the browser sandbox by serving a specially crafted HTML page. The vulnerability manifests when the Chrome process attempts to access a freed memory object during Bluetooth operations, allowing malicious code to run with the browser’s privileges.

The flaw affects all installations of Google Chrome on desktop platforms that use a Bluetooth module, specifically any Chrome release before 154.0.8037.92.

The CVSS score of 9.6 reflects the high severity of this vulnerability, and the EPSS score of less than 1% (0.00373) indicates a very low but non‑zero probability of exploitation in the current environment. The lack of a KEV listing does not diminish the potential for exploitation. Remote exploitation can be achieved from a webpage, and the attack may run code outside the normal sandbox, compromising the entire system if a user visits an infected page. The likelihood of exploitation is high if an attacker can host such a page or influence a user to visit it.