A use after free flaw exists in Chrome’s Bluetooth implementation on macOS versions prior to 149.0.7827.197. The flaw allows an adversary to trigger arbitrary code execution by establishing a Bluetooth connection with Chrome using a specially crafted peripheral. This is a high‑severity issue that could compromise the confidentiality, integrity, and availability of the affected system.

Versions of Google Chrome for macOS older than 149.0.7827.197 are vulnerable. The flaw is specific to the desktop Chrome application and requires that the local machine runs the affected build on a macOS platform.

The vulnerability can be triggered remotely through a Bluetooth peripheral. While the EPSS score is not available, the lack of a KEV listing and high Chromium severity suggest that exploitation is plausible but would require physical proximity or the ability to pair with the target device. No public exploit references exist yet, but users of older Chrome releases should consider the risk of code execution from malicious nearby devices.