The vulnerability is a use‑after‑free flaw in Chrome’s Bluetooth stack that can lead to arbitrary code execution beyond the browser’s sandbox. An attacker can trigger this by delivering a specially crafted HTML page that interacts with the Bluetooth API while the user’s Bluetooth is enabled. This flaw falls under the memory corruption weaknesses represented by CWE‑125 and CWE‑416. Based on the description, it is inferred that the exploit requires the victim to visit the malicious page, making social engineering a prerequisite.

Affected browsers are Google Chrome versions before 156.0.8078.47. The flaw exists on all platforms that ship the stable channel of Chrome, including Windows, macOS, Linux, and Chrome OS. Any installation that has the Bluetooth API enabled is vulnerable, regardless of device type or operating system version.

The CVSS score of 6.5 indicates medium severity. With an EPSS score of less than 1%, the likelihood of exploitation is low, and Chrome is not listed in the CISA KEV catalog. The likely attack vector is a malicious website with a crafted HTML payload that activates the Bluetooth API; an attacker would need to persuade the user to visit the site. Because the flaw allows code execution outside the sandbox, an active exploitation could result in full system compromise, especially if the user has elevated privileges. Despite this, the overall risk remains moderate due to the social engineering requirement and the need for Bluetooth to be enabled.