Missing authorization in the Bluetooth component of Google Chrome before 156.0.8078.47 permits a remote attacker, once the renderer process is compromised and with social engineering using a crafted HTML page, to bypass system access restrictions. The vulnerability represents an authorization bypass (CWE‑862) that could allow the attacker to gain privileges beyond the browser sandbox.

This vulnerability affects Google Chrome browsers installed on any platform that includes the Bluetooth component. All users running Chrome versions older than 156.0.8078.47 are potentially impacted, regardless of operating system, because the vulnerability resides in the cross‑platform Bluetooth implementation.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is < 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation has not been observed. The likely attack vector is a malicious web page that delivers a crafted payload through the Bluetooth interface; the attacker must first compromise the renderer process and then use social engineering to trigger the missing authorization to bypass system access restrictions.