EUVD-2026-105557
GHSA-jc96-p55c-856v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitServe malformed Bluetooth input
-
ExecutionTrigger improper input validation (CWE-20)
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a victim running Chrome before 156.0.8078.47 to navigate to attacker-controlled crafted HTML (UI:R - user interaction is a hard prerequisite and a key limiting factor); no authentication is required (PR:N). The flaw is in Chrome's Bluetooth handling via improper input validation (CWE-20), and resulting code execution is explicitly confined to the browser sandbox per the vendor, so full system compromise would additionally require a separate sandbox escape - a significant practical limiter on real-world impact. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a crafted page). However, this signal conflicts with two mitigating facts that must be weighed: (1) the Chromium team rated this 'Medium' severity, and (2) the description explicitly states code execution occurs 'inside the sandbox' - meaning the attacker does NOT achieve full host compromise without a separate sandbox-escape chain, which the CVSS 8.8 score (S:U, no scope change) does not fully convey in isolation. No EPSS score was provided; KEV status is not present in the input, so per precision rules this is 'no public exploit identified at time of analysis'; no POC is referenced; and no SSVC decision data was supplied. In net terms this is a legitimate browser RCE primitive worth prompt patching given Chrome's enormous footprint, but the sandbox containment and vendor 'Medium' rating suggest it is a component of a potential exploit chain rather than a standalone catastrophic issue - lower real-world priority than the 8.8 number alone implies, absent evidence of active exploitation. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML that triggers the Bluetooth input-validation flaw when a victim using a vulnerable Chrome build visits it. Exploitation requires user interaction (navigation to the page) and, per the description, yields arbitrary code execution confined to the browser sandbox; no public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in Google Chrome's Bluetooth implementation (CWE-20) prior to 156.0.8078.47 allows a remote attacker to achieve arbitrary code execution inside the browser sandbox when a victim navigates to a crafted HTML page. The flaw is unauthenticated and network-reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but requires user interaction, and the vendor explicitly confines the resulting code execution to the sandbox, so full host compromise would require a separate sandbox escape. Chromium rates the issue Medium severity, no public exploit code or CISA KEV confirmation was identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; enterprise fleets should push the update through their normal patch-management channel and verify the reported browser version, and Chromium-derived browsers should be updated once their maintainers ship a build based on Chromium 156.0.8078.47 or newer. Where immediate upgrade is not possible, reduce exposure by disabling the Web Bluetooth API through the enterprise policy DefaultWebBluetoothGuardSetting (set to 2 to block sites from requesting Bluetooth device access) and by disabling Bluetooth on managed endpoints where it is not operationally required - the trade-off being loss of legitimate Bluetooth peripheral and web-app functionality. Additional hardening: restrict users from browsing untrusted sites on unpatched machines and keep site isolation and the renderer sandbox enabled, since the assessed impact is already confined to the sandbox and a second escape bug would be required for host compromise. No public exploit code or CISA KEV confirmation was identified at time of analysis, so no emergency workaround beyond prompt patching is indicated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an improper input validation flaw (CWE-20) in Chrome's Bluetooth component, the Web Bluetooth / device-discovery surface that parses data exchanged with nearby Bluetooth peripherals and exposes it to renderer-side web content. Because Bluetooth responses and descriptors are attacker-influenceable input, insufficient validation of that data can corrupt memory or drive unexpected logic inside the renderer, which the vendor describes as potential arbitrary code execution within the browser sandbox. Per the authoritative assessment, impact is bounded by Chrome's process sandbox: escaped code execution would require chaining a second, independent sandbox-escape vulnerability. The attack path is network-based (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but a victim must browse to attacker-controlled HTML (UI:R), and Chrome's Bluetooth permission prompting adds further friction. Chromium's internal severity rating is Medium despite the 8.8 base score, reflecting the sandbox confinement and interaction requirement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory user navigation (UI:R); sandbox-confined code execution keeps scope unchanged (S:U) with high in-sandbox C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome installations below version 156.0.8078.47 are exposed to a browser-sandbox code-execution risk that is triggered when a user opens a crafted web page, creating potential for user disruption and exposure of browser-accessible data. The vendor rates the underlying issue Medium and confines code execution to Chrome's sandbox, so full device takeover would require a separate exploit, and no public exploit was identified at time of analysis. Leadership should care because Chrome is broadly deployed and the available vendor update makes rapid version compliance the most effective way to reduce organizational exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB