A use‑after‑free flaw (CWE‑416) in Google Chrome’s Bluetooth subsystem on macOS can allow a remote attacker to escape the browser sandbox after a user visits a specially crafted web page and performs specific UI gestures. The vulnerability gives the attacker the ability to execute code at the privilege level of the Chrome renderer process, potentially compromising the host operating system. The ability to escape the sandbox depends on correct memory reuse and the presence of the flaw; it is not a pure remote code execution without user interaction.

Google Chrome builds prior to 150.0.7871.47 running on macOS are affected. Versions 150.0.7871.47 and later contain a fix and are not impacted.

Chromium marks this defect as critical, assigning a CVSS score of 9.6. The EPSS score is < 1 %, indicating a low probability of exploitation, but the flaw remains dangerous if an attacker can convince a user to interact with malicious content. An exploit requires the victim to open the crafted page and perform the specific gestures; if those conditions occur, the use‑after‑free can lead to sandbox escape and potential code execution. The vulnerability is not listed in the CISA KEV catalog.