A flaw in the enforcement of Bluetooth policies within Google Chrome allowed a remote attacker to elevate privileges by loading a specially crafted HTML page. Because the browser does not properly validate the permissions required for Bluetooth interactions, a malicious page can obtain higher authority within the Earth browser context, potentially enabling broader access to system resources that the user normally would not grant.

The vulnerability applies to Google Chrome browsers on desktop platforms prior to release 150.0.7871.47. Users running any earlier stable channel version of Chrome are affected.

The CVSS score is not provided, the EPSS score is unavailable and the issue is not listed in CISA KEV, indicating a low overall exploit probability at present. Nonetheless, the attack vector is a remote attack via a crafted web page that a victim might visit or receive; the exploited weakness is a lack of proper authorization for Bluetooth operations. The impact is privilege escalation, which could allow further compromise of the user’s machine if the attacker gains sufficient leverage.