CVE-2026-13903 - Vulnerability Details

Description

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

Published: 2026-06-30

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Chrome Bluetooth subsystem enforces insufficient policy, allowing a crafted web page to invoke privileged Bluetooth operations. An attacker can elevate local privileges by exploiting this flaw, which is identified as a privilege escalation weakness (CWE‑602).

Affected Systems

All installations of Google Chrome versions older than 150.0.7871.47 that have Bluetooth enabled and permit API access from untrusted origins are vulnerable. The vulnerability applies to any platform running the affected browser version, as no operating‑system restriction is mentioned.

Risk and Exploitability

The CVSS score of 8.8 signals high severity, yet the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, implying limited exploitation likelihood at present. Inferred attack vectors include a malicious web page that serves a custom HTML document capable of triggering the elevated Bluetooth calls, due to the description’s mention of a crafted HTML page.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[0,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Chrome to version 150.0.7871.47 or newer
If an upgrade is not immediately possible, disable the Bluetooth API via enterprise policy or an appropriate command‑line flag
Restrict access to the Bluetooth API for untrusted origins by applying content‑security policies or blocking the API

Generated by OpenCVE AI on August 2, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00345.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/503912196

History

Sun, 02 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title	Bluetooth API Privilege Escalation via Untrusted Origins in Google Chrome

Sun, 26 Jul 2026 00:00:00 +0000

Type	Values Removed	Values Added
Title		Bluetooth API Privilege Escalation via Untrusted Origins in Google Chrome

Wed, 22 Jul 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Unrestricted Bluetooth API in Chrome

Wed, 15 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Unrestricted Bluetooth API in Chrome

Tue, 14 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Title	Chrome Bluetooth Privilege Escalation Vulnerability

Sun, 12 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title		Chrome Bluetooth Privilege Escalation Vulnerability

Sat, 11 Jul 2026 17:15:00 +0000

Type	Values Removed	Values Added
Title	Bluetooth Policy Enforcement Flaw Enables Remote Privilege Escalation in Chrome

Fri, 10 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title		Bluetooth Policy Enforcement Flaw Enables Remote Privilege Escalation in Chrome

Thu, 09 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
Title	Bluetooth Policy Enforced Privilege Escalation in Google Chrome

Tue, 07 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Title		Bluetooth Policy Enforced Privilege Escalation in Google Chrome

Mon, 06 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title	Bluetooth Policy Enforcement Failure Allows Privilege Escalation in Google Chrome

Mon, 06 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Title		Bluetooth Policy Enforcement Failure Allows Privilege Escalation in Google Chrome

Sun, 05 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Policy Enforcement in Chrome Bluetooth API Leads to Privilege Escalation

Sat, 04 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Policy Enforcement in Chrome Bluetooth API Leads to Privilege Escalation

Sat, 04 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Unchecked Bluetooth Policy in Google Chrome

Fri, 03 Jul 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Unchecked Bluetooth Policy in Google Chrome

Fri, 03 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title	Privilege Escalation via Bluetooth Policy Enforcement in Google Chrome

Thu, 02 Jul 2026 23:00:00 +0000

Type	Values Removed	Values Added
Title		Privilege Escalation via Bluetooth Policy Enforcement in Google Chrome

Thu, 02 Jul 2026 09:15:00 +0000

Type	Values Removed	Values Added
Title	Google Chrome Bluetooth Privilege Escalation via Crafted HTML Page

Wed, 01 Jul 2026 22:30:00 +0000

Type	Values Removed	Values Added
Title		Google Chrome Bluetooth Privilege Escalation via Crafted HTML Page

Wed, 01 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	Privilege escalation via Bluetooth in Google Chrome through crafted HTML
Weaknesses	CWE-250 CWE-285

Wed, 01 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-602
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 10:45:00 +0000

Type	Values Removed	Values Added
Title		Privilege escalation via Bluetooth in Google Chrome through crafted HTML
Weaknesses		CWE-250 CWE-285

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/503912196

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:38:15.613Z

Updated: 2026-07-02T03:57:03.953Z

Reserved: 2026-06-29T23:03:48.320Z

Link: CVE-2026-13903

Vulnrichment

Updated: 2026-07-01T14:07:04.609Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-02T00:45:03Z

Weaknesses

CWE-602
Client-Side Enforcement of Server-Side Security

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object