This vulnerability involves a use-after-free condition in the Bluetooth functionality of Google Chrome on Mac platforms before version 148.0.7778.216. Exploitation requires social engineering to get the user to install a crafted malicious Chrome extension, which then can execute arbitrary code on the affected system. The issue was assigned CVE-2026-9964 and is recognized as a high-severity security flaw by the Chromium project. The vendor advisory references a stable channel update but does not explicitly state the patch status for this vulnerability. No CVSS score is available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on a Mac system running an affected version of Google Chrome, potentially leading to full compromise of the browser environment. The attack vector requires user interaction in the form of installing a malicious Chrome extension. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users should update Google Chrome to version 148.0.7778.216 or later once confirmed patched. Until then, avoid installing untrusted Chrome extensions, especially those requesting Bluetooth permissions.