Technical impact
A flaw in the way Google Chrome enforces policy on Web Bluetooth allows an attacker who has already compromised the renderer process to escape the sandbox. The vulnerability involves improper validation of the Bluetooth device's access permissions (CWE‑602) and missing authorization controls (CWE‑280), leading to potential privilege escalation. Once the sandbox is breached, the attacker can execute arbitrary code with the renderer process’s privileges. Chromium reviewers rated the defect as low severity, indicating that while the technical impact is significant, the conditions for exploitation are restrictive.
Affected Systems
The issue affects the Google Chrome browser on desktop platforms. All versions prior to 149.0.7827.53 are susceptible, as the fix was implemented in that release. The vulnerability is present in the Web Bluetooth implementation used by Chrome's renderer process.
Risk and Exploitability
Exploitation requires an attacker to have already compromised the renderer process or otherwise subvert Chrome's sandbox. The CVSS score of 8.3 indicates a high severity, while the EPSS score of <1% and the absence from the CISA KEV catalog suggest a low probability of widespread exploitation. However, once the sandbox is breached, the attacker can execute arbitrary code with the renderer process’s privileges. The primary attack vector is inferred to be a crafted web page that leverages the Web Bluetooth API, requiring the victim to interact with it in a browser run by Chrome.
Debian DSA