What is the CVSS score of CVE-2026-14035?

CVE-2026-14035 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14035?

Yes, a patch is available for CVE-2026-14035. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14035

EUVD-2026-40722 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-72jh-248p-q66p

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network attack via crafted page requires passive user visit (UI:R, PR:N); confidentiality-only impact from process memory read; scope unchanged within browser process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:38 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient Bluetooth policy enforcement in Google Chrome prior to 150.0.7871.47 allows remote attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 Medium at NVD, though Chromium's own severity rating is 'Low,' suggesting Chrome's sandbox architecture limits practical memory exposure. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-284 (Improper Access Control) identifies the root cause as failure to properly enforce access control policies within Chrome's Bluetooth subsystem, specifically the Web Bluetooth API that permits web content in a secure context to interact with nearby Bluetooth devices. Chrome's multi-process architecture assigns renderer processes to web content and relies on policy enforcement layers to constrain what data those processes can access or expose. When the Bluetooth policy layer is insufficiently enforced, a specially crafted HTML page served to a renderer process can bypass these restrictions and read data from process memory that would ordinarily be inaccessible to web content. The affected product is Google Chrome across all desktop platforms (Windows, macOS, Linux) for versions prior to 150.0.7871.47, as confirmed by EUVD-2026-40722 and the vendor Stable Channel advisory.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released fix per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates for consumer installations; enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify that update policies enforce the 150.0.7871.47 minimum and confirm deployment via version inventory tooling. As a compensating control prior to patching, enterprise administrators can disable Web Bluetooth API access by setting the DefaultBluetoothGuardSetting policy to BlockBluetooth (value 2) - this eliminates the attack surface entirely but will break any legitimate web applications relying on Bluetooth connectivity, which is a meaningful trade-off in environments using web-based Bluetooth device management tools.