A use‑after‑free vulnerability exists in the macOS Bluetooth implementation of Google Chrome versions earlier than 150.0.7871.47. The flaw, classified as CWE-416, occurs when a malicious extension frees memory that Chrome later accesses, allowing the attacker to execute arbitrary code within the browser process with the same privileges as Chrome. The description does not indicate any automatic privilege escalation beyond the Chrome process.

macOS users running Google Chrome older than 150.0.7871.47 who install or run third‑party Chrome extensions are affected. The vulnerability is confined to the Chrome instance and its Bluetooth subsystem, with no direct impact on other macOS components unless code execution is achieved within Chrome and then transferred elsewhere.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild, and because the vulnerability is not listed in the KEV catalog, there are no publicly known exploits. Therefore, the primary mitigation is to guard against social‑engineering that would lead to malicious extension installation and to apply the official browser update when available.