Incorrect authorization in the Bluetooth stack of Google Chrome prior to version 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. This flaw corresponds to the authorization weakness CWE-863 and can compromise the confidentiality of the victim’s data when privileged Bluetooth interactions are invoked.

All users running Google Chrome desktop version 156.0.8078.46 or earlier are affected. The vulnerability resides in the default Chrome installation and is not limited to particular extensions or operating systems.

The CVSS score of 8.8 indicates a high impact risk, and the vulnerability is currently not listed in the CISA KEV catalog. EPSS data is < 1%, indicating a very low probability of exploitation today, although the flaw could be leveraged by a remote attacker who has already compromised the renderer process. The likely attack vector is remote delivery of a malicious HTML page that triggers the incorrect authorization check within the Bluetooth subsystem.