CVE-2026-9881
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A Use-After-Free vulnerability was found in the Bluetooth component of Google Chrome on Mac prior to version 148.0.7778.216. An attacker who convinced a user to install a malicious extension could potentially perform a sandbox escape via a crafted Chrome Extension.
Risk Assessment
The risk for the organization is the potential complete bypass of browser sandboxing mechanisms, which could lead to system compromise and data theft.
Recommendation
Immediately update Google Chrome on all Mac computers to version 148.0.7778.216 or later. Restrict extension installation to trusted sources only.
Original NVD description (English source)
Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)