Description
Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in Chromium’s Bluetooth handling code that may allow an attacker who has already compromised the renderer process to escape the sandbox by delivering a specially crafted HTML page.

Affected Systems

Google Chrome for Android versions before 151.0.7922.72, including older Chrome releases that have not applied the latest stable update.

Risk and Exploitability

The CVSS score of 5.0 indicates medium severity while the EPSS score of less than 1% suggests low likelihood of spontaneous exploitation; the vulnerability is not listed in KEV. Exploitation requires an attacker to supply malicious HTML and first gain code execution in the renderer, making it a non‑trivial attack that could still lead to local privilege escalation if the conditions are met.

Generated by OpenCVE AI on August 3, 2026 at 12:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 151.0.7922.72 or later
  • Ensure Android OS is updated with the latest security patches to protect the underlying Bluetooth stack
  • Disable Bluetooth permissions for websites in Chrome settings until the update is applied

Generated by OpenCVE AI on August 3, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Use after free in Bluetooth
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T18:43:38.375Z

Reserved: 2026-07-27T23:34:34.399Z

Link: CVE-2026-17737

cve-icon Vulnrichment

Updated: 2026-07-30T18:43:29.395Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:36.483

Modified: 2026-08-03T13:47:21.563

Link: CVE-2026-17737

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:07Z

Links: CVE-2026-17737 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:30:17Z

Weaknesses