CVE-2026-79091 in Chrome
Summary
by MITRE • 08/26/2026
Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-8389 represents a critical memory safety flaw within the Bluetooth implementation of Google Chrome on macOS, specifically affecting versions prior to 152.0.797.65. This issue is classified as an out-of-bounds write resulting from use-after-free conditions in the Blink rendering engine and associated components that handle WebBluetooth API interactions. The core technical flaw arises when a JavaScript object referencing Bluetooth device data is deallocated by the garbage collector while asynchronous callbacks or event handlers still hold references to it. When these dangling pointers are subsequently accessed, they point to memory regions that may have been reallocated for other purposes, allowing an attacker to write arbitrary data into unintended memory locations. This type of error is a classic manifestation of CWE-416, Use After Free, which remains one of the most prevalent and dangerous classes of vulnerabilities in complex software systems due to its potential for code execution.
The operational impact of this vulnerability is severe because it enables remote code execution outside the browser's sandbox environment. Attackers can leverage social engineering tactics to trick users into visiting a maliciously crafted HTML page that exploits the race condition inherent in the Bluetooth API handling. By carefully timing memory allocations and deallocations, an attacker can manipulate the heap layout to achieve arbitrary read-write primitives. This capability allows for the bypass of Chrome's sandboxing mechanisms, which are designed to isolate web content from the underlying operating system. Once the sandbox is breached, the malicious code gains elevated privileges on the host machine, potentially leading to full system compromise, data exfiltration, or installation of persistent malware. The severity rating of Medium by Chromium reflects the complexity required for exploitation but acknowledges the high impact if successful.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, where adversaries use vulnerabilities in client software to execute code on victim systems. The reliance on social engineering indicates that initial access is often facilitated through phishing campaigns or malicious websites designed to exploit user trust rather than purely technical exploits of network services. This distinction highlights the importance of both technical controls and security awareness training. While the vulnerability exists in a specific component, its interaction with web standards means it affects any user interacting with Bluetooth-enabled web applications without adequate protection layers.
Mitigation strategies primarily involve immediate software updates to ensure all Chrome instances are running version 152.0.797.65 or later on macOS platforms. Organizations should enforce automatic update policies for browsers across their endpoints to minimize the window of exposure. Additionally, implementing strict Content Security Policy (CSP) headers can help mitigate some aspects of web-based exploitation by restricting script execution sources and preventing inline scripts that might be used in crafted payloads. For high-security environments, disabling unnecessary Bluetooth APIs via browser flags or enterprise policies may reduce the attack surface if such functionality is not required for business operations. Regular security audits and penetration testing focusing on memory safety issues can also help identify similar vulnerabilities before they are exploited in the wild.