EUVD-2026-40589
GHSA-pv8j-6v7f-j6h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage invokes Web Bluetooth API
-
ExecutionBypass insufficient Bluetooth policy enforcement
-
ImpactEscalate privileges within browser context
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build (UI:R user interaction), and depends on the Web Bluetooth code path in Chrome's Bluetooth policy enforcement being reachable from web content. It is unauthenticated (PR:N) and network-delivered (AV:N) with low complexity (AC:L), but limited by the need for user interaction and by the fact that only Chrome versions before 150.0.7871.47 are affected; environments that disable Web Bluetooth via the DefaultWebBluetoothGuardSetting policy remove the exposed surface. The Chromium team's internal 'Medium' rating further suggests the achievable privilege gain is more constrained than NVD's total-impact scoring implies. |
| Impact | The signals conflict and warrant caution. NVD's CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H) paints a high-severity network-reachable bug, and SSVC lists Technical Impact as 'total,' yet Google's Chromium team internally rated this only Medium, EPSS is low (0.22%, 12th percentile), SSVC Exploitation is 'none,' and Automatable is 'no.' The requirement for user interaction (UI:R - the victim must open attacker-controlled content) and the absence of any known exploit or KEV listing materially lower real-world urgency relative to the raw 8.8. The most likely reading is that NVD's full C:H/I:H/A:H impact is inflated for what Chromium characterizes as a medium-severity Bluetooth policy bypass; defenders should treat this as a routine 'patch in the normal Chrome auto-update cycle' item rather than an emergency, absent new exploitation evidence. Note the conflict explicitly: NVD 8.8/SSVC-total vs. vendor 'Medium' - the vendor's rating is the more authoritative characterization of impact. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a victim (phishing link or malvertising) into opening it in an unpatched Chrome; the page's JavaScript abuses the insufficiently enforced Bluetooth policy to escalate its privileges beyond the intended permission boundary. No credentials are needed, but the victim must actively visit the page. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the Chrome Stable channel; most installs will receive this automatically, so verify auto-update is enabled and force a relaunch (chrome://settings/help) to apply immediately. For managed fleets, push the fixed build through your enterprise update tooling (Google Update/ADMX policies) and confirm SUSE/Chromium repackages are updated to the corresponding patched version. If patching cannot be completed immediately, a targeted compensating control is to disable Web Bluetooth via the DefaultWebBluetoothGuardSetting enterprise policy (set to block), which prevents pages from accessing the Bluetooth API - the trade-off is that any legitimate internal web apps relying on Web Bluetooth will break. Reference: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's implementation of the Web Bluetooth API, which exposes Bluetooth GAP/GATT device access to web content under a permission and policy model enforced by the browser. CWE-602 (Client-Side Enforcement of Server-Side Security) indicates that a security decision that should be authoritatively enforced was instead performed in a bypassable client-side context, so a crafted page can subvert the intended Bluetooth policy/permission gating and reach capabilities it should not have. The affected component is the Chromium browser engine (cpe:2.3:a:google:chrome), meaning every Chromium-derived channel shipping this Bluetooth code before the fixed build is potentially in scope, though only the Google Chrome CPE is explicitly enumerated here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered page requiring user interaction (UI:R), unauthenticated (PR:N); impact scored Low/Low to reflect Chromium's own Medium rating for a scoped Bluetooth policy bypass rather than NVD's full C:H/I:H/A:H.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
2DescriptionCVE.org
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A privilege escalation vulnerability in Google Chrome (CVE-2026-13903, CVSS 8.8) enables attackers to bypass security controls and gain elevated system access when employees visit malicious websites, creating material risk of data breach or credential theft. While no public exploit has been identified at time of analysis, the low barrier to attack through email or web browsing makes this a significant threat to the enterprise. A patch is available and should be deployed across all desktops within the week.
Apply vendor patch (Chrome 150.0.7871.47 or later)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Same technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB