Use‑after‑free in Chrome's Bluetooth code allows a malicious extension to trigger a memory error that may lead to a sandbox escape. The flaw is triggered when an attacker convinces a user to install a crafted Chrome Extension on macOS. The Chromium security team has rated the issue as Critical, and the defect originates from improper deallocation of memory used by the Bluetooth stack, which an attacker can exploit to run untrusted code outside the browser sandbox.

The vulnerability affects Chrome for macOS versions earlier than 148.0.7778.216. Users running such versions are at risk if they install arbitrary extensions from sites that are not part of the Chrome Web Store or that are otherwise malicious. Google Chrome distributes subsequent releases that contain the fix.

Because the EPSS score is <1% and the issue is not listed in CISA KEV, formal exploitation data is limited. Nevertheless, the correct attack path requires social engineering to have a user install a bad extension, a commonly observed attack technique. The CVSS score of 9 indicates high severity in line with the Chromium security team's Critical classification. The low EPSS suggests the likelihood of exploitation is low, but the possibility of sandbox escape means the risk remains high for any Mac system running an affected Chrome version. An exploitable code path exists if the browser code runs with insufficient isolation when the freed memory is accessed.