Google Chrome CVE-2026-14036

Exploitation requires the victim to actively open or visit an attacker-controlled crafted HTML page (CVSS UI:R makes user interaction mandatory), so it cannot be triggered silently at scale. No authentication is required (PR:N), the vector is network-delivered (AV:N), and complexity is low (AC:L). The specific enabling factor is Chrome's Bluetooth policy-enforcement path being reachable from web content; practical impact is limited by Chromium's own 'Low' severity triage and by the requirement that the browser build be earlier than 150.0.7871.47, so patched or auto-updated browsers are not exposed. Environments that have disabled Web Bluetooth by policy further limit or remove exploitability.

The signals conflict and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) suggests a severe, network-reachable, unauthenticated issue needing only that a user open a page, but it is offset by Chromium's internal severity rating of 'Low', which strongly implies the real-world impact of a Bluetooth policy bypass is far more constrained than full high-impact compromise. EPSS is low (0.17%, 7th percentile), the vulnerability is not on the CISA KEV list, and no public exploit has been identified, so this is not an urgent in-the-wild threat. Net assessment: this is a routine browser-hardening fix best handled through normal Chrome auto-update cadence rather than emergency patching; the headline 8.8 appears to overstate operational risk given the vendor's own 'Low' triage and the absence of exploitation evidence. Explicit caveat: raw CVSS High versus vendor 'Low' severity is a genuine conflict, so treat the 'C:H/I:H/A:H' impact metrics as uncorroborated.

An attacker hosts a crafted HTML page and lures a victim to open it via a phishing link, malicious ad, or compromised site; on load, the page abuses the Bluetooth policy-enforcement gap to reach an access or action boundary that browser policy should have blocked, achieving the described privilege escalation. No public exploit code has been identified, and success depends on the user actually visiting the page (UI:R).