Chrome Android EUVD-2026-50687

Exploitation requires two stacked conditions: first, the attacker must have already achieved code execution within Chrome's renderer process on Android - a significant prerequisite typically requiring a separate, unpatched renderer vulnerability; second, the victim user must interact with a crafted HTML page (UI:R) that triggers the Bluetooth IPC path leading to the UAF. The Bluetooth component must be reachable via the renderer's IPC surface, which is the default configuration on Android devices with Bluetooth enabled. Factors limiting exploitation include: the high attack complexity (AC:H) of chaining a renderer compromise with this escape; the requirement for user interaction to initiate the HTML delivery; and the Android-platform-specific scope, which excludes desktop Chrome deployments. Exploitation is not feasible against Chrome on Windows, macOS, Linux, or iOS based on available data.

The raw CVSS 5.0 score and Medium severity designation reflect a vulnerability that requires significant prior work: the attacker must already control the renderer process, implying a separate, unpatched renderer exploit is a prerequisite. CVSS AC:H corroborates this high exploitation complexity. EPSS at 0.21% (11th percentile) is very low, consistent with a chaining vulnerability that has no standalone exploit path. There is no CISA KEV listing and no reported POC. The SSVC picture is therefore: exploitation status = none confirmed, automatable = no (requires renderer compromise and user interaction), technical impact = partial (sandbox escape, but impacts bounded by C:L/I:L/A:L). A notable inconsistency exists: the CVE description explicitly characterizes this as a 'sandbox escape,' which canonically implies a changed scope (S:C), yet the NVD-published CVSS vector records S:U (Unchanged). This discrepancy should be verified with the Chrome security team advisory; if scope change is confirmed, the effective risk is higher than the published score suggests. Overall, this is a real but low-urgency finding outside active exploitation - patching is warranted but does not demand emergency response absent a companion renderer bug.

An attacker operating a malicious or compromised website first exploits a separate renderer vulnerability to gain code execution within Chrome's sandboxed renderer process on an Android device. From within the renderer, the attacker sends crafted IPC messages to Chrome's Bluetooth component in the browser process, triggering the use-after-free to corrupt memory and redirect execution, achieving code running at browser-process privilege outside the renderer sandbox. No public exploit code for this specific vulnerability has been identified at time of analysis.