Google Chrome CVE-2026-17986

Two sequential conditions must both be met: first, the attacker must have already compromised the renderer process - this requires a separate, distinct vulnerability enabling renderer-level code execution. Second, user interaction is required (UI:R): the victim must visit or be served a crafted HTML page within the compromised browser session. The Web Bluetooth API (or equivalent Bluetooth-interfacing browser subsystem) must be accessible in the browser. Factors limiting exploitation: renderer compromise is a non-trivial prerequisite that constitutes its own separate exploit chain; the vulnerability does not enable unauthenticated remote exploitation from a clean browser state; and the confidentiality impact is absent (C:N), meaning the SOP bypass yields integrity violation rather than data exfiltration per the CVSS vector.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) overstates exploitability: the description explicitly requires a previously compromised renderer process, which is a significant attack complexity prerequisite not reflected by AC:L or PR:N in the assigned vector. This is a tension in the data that defenders should note - the score of 6.5 implies moderate risk, but the chained nature of the attack (renderer RCE first, then this SOP bypass) makes standalone exploitation impossible. The Chromium team's own 'Low' severity rating is more consistent with the real-world risk profile. EPSS at 0.18% (8th percentile) corroborates low observed exploitation interest. No POC is publicly confirmed, and the vulnerability is not listed in CISA KEV. This is a real but lower-priority issue, best addressed through the standard Chrome update cycle rather than emergency patching.

An attacker first exploits a separate renderer-process vulnerability (such as a V8 or Blink memory corruption bug) to gain code execution within Chrome's sandboxed renderer. From that foothold, they serve the victim a crafted HTML page that abuses the insufficient Bluetooth policy enforcement to issue cross-origin requests or access data from origins that should be isolated, effectively breaking the same-origin policy for the compromised session. No public POC for this specific chained attack is confirmed at time of analysis.