CVE-2026-13785 is a critical use after free (CVSS 9.6) in Bluetooth in Google Chrome on Mac before 150.0.7871.47. Chromium rates it Critical. A user would have to perform specific UI gestures on a crafted page, and a sandbox escape could follow. Update Chrome to 150.0.7871.47 or later.
What's affected
The record says Google Chrome prior to 150.0.7871.47 is affected, on Mac only for this issue. The fixed version is 150.0.7871.47 or later. The record points to the June 2026 Chrome stable channel update post for the desktop release notes. That page loads its content with scripts and did not render for our fetch, so open it in a browser to see the exact build numbers per platform.
Other Chromium based browsers take Chromium fixes on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the address bar and read the version number. Anything below 150.0.7871.47 is in range. To trigger an update, open the three dot menu, choose Help, then About Google Chrome, and relaunch when asked.
For managed fleets, check the version through your device management console or with a script that reads the installed Chrome version on each platform.
What to do now
- Open chrome://version and check the build is 150.0.7871.47 or later.
- Use About Google Chrome to update and relaunch the browser.
- Confirm your fleet policy lets Chrome update, and relaunch long running sessions.
- Check other Chromium based browsers and embedded runtimes such as Electron apps against their vendor advisories.
- Keep an eye on the Chrome releases blog for new stable updates.
Why it matters
The record limits this bug to Chrome on Mac and says the attacker must convince a user to engage in specific UI gestures. That is a real social requirement, and it is why the vector shows user interaction as required. The class is use after free.
Sandbox escapes matter because Chrome counts on the sandbox to contain a bad page. If you run Chrome on Mac, update and relaunch. Windows and Linux builds are not named in the record for this CVE. It does not flag the CVE as known exploited.
The record lists this weakness class: CWE-416 (Use After Free).
Quick check
Do Windows and Linux users need to act on this one?
The record names Chrome on Mac. They should still update to the same release, since it carries fixes for other CVEs.
Sources
Last reviewed: 19 October 2026.
