EUVD-2026-40565
GHSA-4ccf-vvrm-fqpq
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Bluetooth adjacency mandates physical proximity; no attacker auth needed; impact is process memory read only, no integrity or availability loss.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Medium)
AnalysisAI
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Technical ContextAI
CWE-416 (Use After Free) describes a memory safety defect where a heap-allocated object is freed but a dangling pointer to that memory region persists and is later dereferenced. In Chrome's Bluetooth stack, this occurs during processing of data received from a connected or connecting Bluetooth peripheral. Bluetooth in Chrome is implemented in C++ and interfaces with the OS Bluetooth stack to support both the Web Bluetooth API and internal browser features. When a specially crafted peripheral triggers the vulnerable code path - likely during device enumeration, pairing negotiation, or service discovery - the freed memory block can be read by the attacker-controlled peripheral's response flow, exposing in-process data. No CPE strings were provided in the input; affected product scope is derived from the EUVD entry EUVD-2026-40565 covering Chrome versions prior to 150.0.7871.47.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later immediately via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or by referencing the stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments where patching is not immediately feasible, disabling Bluetooth at the operating system level prevents Chrome from accessing the Bluetooth stack entirely, eliminating the attack surface at the cost of all Bluetooth functionality including peripheral devices and Web Bluetooth API features. Enterprise administrators can enforce minimum Chrome version requirements through Chrome Browser Cloud Management or Group Policy to ensure fleet-wide remediation. For high-sensitivity environments, additionally restricting physical access to areas where unvetted Bluetooth devices may be introduced further reduces proximity-based risk.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today