Google Chrome versions before 151.0.7922.72 suffer an insufficient policy enforcement flaw in the Bluetooth subsystem. If an attacker can already compromise the renderer process, they can serve a crafted HTML page that causes the browser to perform Bluetooth operations without the expected same-origin checks. The flaw allows the attacker to read or interact with resources that belong to a different origin, effectively bypassing the browser’s same‑origin policy and exposing confidential data. This is an access control weakness (CWE‑284) that could allow further exploitation once the renderer is compromised.

The vulnerability affects any user running Google Chrome desktop on the stable channel with a build older than 151.0.7922.72. The issue is independent of the underlying operating system because it resides entirely in the Chrome binaries. Any web content that initiates Bluetooth interactions is potentially affected if the user’s browser version is vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1 percent demonstrates that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain control over the renderer process, typically through another vulnerability or malicious content, and then present a malicious HTML page that triggers the faulty Bluetooth policy. Because the attack occurs locally on the victim’s machine, the impact is confined to the compromised system unless the attacker leverages the stolen data for broader attacks.