The vulnerability stems from an incorrect authorization check in Chrome's Bluetooth implementation. A remote attacker can craft an HTML page that accesses the Bluetooth API without proper permission, allowing the attacker to read sensitive information such as device identifiers or pairing details. The flaw is classified as CWE‑863, Missing Authorization Checks, and the Chromium severity rating is medium.

Products affected are versions of Google Chrome before 155.0.8059.39. The issue applies to all platforms that support the Bluetooth API in Chrome, including desktop operating systems. Users running any pre‑155.0.8059.39 release are potentially vulnerable until they upgrade to a fixed build.

Although no EPSS score is available and the vulnerability is not listed in CISA's KEV, the CVSS score of 8.8 indicates high severity and a significant exploitation risk. The attack can be performed over the network by hosting a malicious web page that triggers the unauthorized Bluetooth access. The lack of an official workaround means that the only practical defense is to apply the vendor patch or otherwise restrict Bluetooth usage via policies.