A use‑after‑free defect in the Bluetooth subsystem of Google Chrome on macOS permits a remote attacker to force a browser process to read or write arbitrary memory, resulting in a sandbox escape and possible code execution with the privileges of the Chrome process, as identified by CWE‑416.

The flaw affects Google Chrome browsers running on macOS when the version is older than 150.0.7871.47; any build prior to that revision is vulnerable and newer revisions are not impacted.

Chromium labels the issue as critical, but no CVSS score or EPSS value is publicly available and it is not listed in the CISA KEV catalog. The attack requires the victim to open a specially crafted HTML page and perform certain UI gestures, after which the use‑after‑free can be triggered. If these conditions are met, the attacker can escape the sandbox and execute code with browser‑process privileges.