EUVD-2026-105454
GHSA-766g-rhv5-f8cc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger out-of-bounds read in Bluetooth handling
-
ExecutionLeak adjacent sandbox memory
-
ImpactExfiltrate disclosed data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a Chrome build prior to 156.0.8078.47 and to actively visit or render an attacker-crafted HTML page (UI:R), which triggers the out-of-bounds read in Chrome's Bluetooth component; no authentication or elevated privileges are needed (PR:N). Limiting factors: the mandatory user-interaction step means the attack cannot be fully automated or self-propagating, impact is confined to reading memory inside the renderer sandbox (no write, no code execution, no availability loss on its own), and users on the patched version or with auto-update enabled are not exposed. |
| Impact | This is a moderate-severity information-disclosure flaw that signals are consistent on: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a remote, low-complexity, unauthenticated attack that requires user interaction and yields only confidentiality impact (an out-of-bounds read of memory inside the renderer sandbox) with no integrity or availability effect. The EPSS score of 0.23% (13th percentile) is low, indicating low near-term probability of widespread exploitation, and this aligns with the absence of a CISA KEV listing and no identified public POC - there is no evidence of active or impending mass exploitation. No SSVC decision data was provided in the input. The signals do not conflict: a mid-range CVSS driven by read-only impact plus mandatory user interaction, combined with low EPSS and no KEV/POC, points to a genuine but non-urgent patch-cycle issue rather than an emergency. The practical caveat is that Chrome's ubiquity and the ease of luring users to a crafted page mean an OOB read leaking sandbox memory can be a useful primitive when chained with a sandbox-escape bug, so it should not be dismissed despite the modest standalone score. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted content that drives Chrome's Bluetooth handling into an out-of-bounds read, and lures a victim into visiting it. When the page loads, the flaw leaks adjacent memory contents from within the renderer sandbox back to attacker-controlled script, disclosing potentially sensitive data. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds memory read in Google Chrome's Bluetooth component (all builds prior to 156.0.8078.47) allows remote attackers to disclose memory contents from inside the renderer sandbox by getting a victim to load a crafted HTML page. Exploitation is remote, low-complexity, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), but requires the target to visit or render the attacker's page, and grants only confidentiality impact - no memory write, code execution, or service disruption on its own. Chromium rates the issue High severity; EPSS is 0.23% (13th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis. Affected users are those on Chrome builds older than 156.0.8078.47, including ChromeOS devices tracked by the parallel stable-channel advisory.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - the vendor-released patch for this issue - via the built-in updater (chrome://settings/help) or your enterprise deployment channel, and apply the corresponding ChromeOS stable-channel update from http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html; details are in http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Verify version compliance fleet-wide rather than assuming auto-update has fired, since the only prerequisite for exploitation is running a pre-156.0.8078.47 build and rendering a crafted page. If immediate upgrade is not possible, set the Web Bluetooth policy to block (DefaultWebBluetoothGuardSetting = 2, or 3 to also block the Web Bluetooth API entirely) to remove the reachable attack surface from web content - accepting that this breaks Bluetooth-dependent web applications and device-pairing workflows for users until it is reverted. Alternatively, tightening site restrictions or disabling Bluetooth on managed endpoints reduces practical exposure but is weaker than removing the API surface, and browser flags should be treated as temporary until the patch is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-125 out-of-bounds read in Chromium's Bluetooth implementation, the code path that backs the Web Bluetooth API and Bluetooth device discovery/connection handling inside the browser. Because Bluetooth operations are brokered between the renderer and the browser process, malformed input surfaced through a crafted HTML page can drive the component past the end of an allocated buffer and read adjacent memory rather than corrupt it - which is why the assessed impact is confidentiality-only (C:H/I:N/A:N). The interesting containment property is that the disclosure is described as reading memory *inside the sandbox*, meaning the primitive stays within the renderer's isolated address space rather than providing a sandbox escape or a browser-process compromise; a separate bug would be needed to escalate it into something more serious. The patch landed in the Chrome 156.0.8078.47 stable release, and the underlying engineering detail is captured in the restricted Chromium issue tracker entry 566687517, which is typically locked down until most users have updated. No CPE data was supplied, so exact build/platform enumeration must come from the vendor advisories; CWE-125 is the root-cause class and explains both the read-only nature of the primitive and the absence of integrity or availability effects.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth (AV:N, PR:N, AC:L) but requiring the user to open it (UI:R); read-only memory disclosure gives C:H with I:N/A:N and no sandbox-level scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB