Google Chrome EUVD-2026-93676

Exploitation requires the victim to use an unpatched Google Chrome build prior to 155.0.8059.39 and to actively open an attacker-crafted HTML page (UI:R) that exercises the Web Bluetooth path - it is not a no-interaction drive-by. No authentication is required (PR:N, unauthenticated remote attacker). The incorrect authorization (CWE-863) is in Chrome's Bluetooth handling, so the browser must reach that vulnerable Bluetooth code path; the primary limiting factors are the mandatory user interaction and the need for the victim to run a vulnerable Chrome version. The weakness is in the client browser itself, so no non-default server configuration is implicated.

Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) claims high impact across confidentiality, integrity AND availability, yet the CVE description states only that the flaw 'allowed a remote attacker to obtain sensitive information' - a confidentiality-only outcome - and Google's own Chromium severity rating is Medium, not High/Critical. The I:H/A:H claim is not supported by the described information-disclosure behavior and should be treated as an inflated/aggregator-assigned vector; real severity is closer to Medium. No EPSS score, no CISA KEV listing, and no public POC appear in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Exploitation is further gated by required user interaction (UI:R) - the victim must open an attacker-controlled HTML page - which lowers real-world risk below what the 8.8 number implies. Net: patch as part of normal Chrome update hygiene, but this is a high-CVSS-number / moderate-real-risk issue rather than an emergency. Verify true impact scope (confidentiality only vs. C/I/A) against the vendor advisory.

A remote attacker lures a victim into visiting a malicious web page that abuses Chrome's Web Bluetooth authorization logic. Because authorization is incorrectly enforced, the page accesses Bluetooth-related data it should not be permitted to read, leaking sensitive information from the browser or paired devices. No public exploit code is identified at time of analysis, and the attack requires the victim to actively open the crafted page (UI:R).