The flaw stems from incomplete cleanup of Bluetooth resources in Chrome versions prior to 154.0.8037.57, allowing a remote attacker to use a crafted HTML page that bypasses system access restrictions if the user is lured to it. The weakness is a use of uninitialized variable (CWE‑459). Successful exploitation could grant the attacker elevated privileges, jeopardizing system confidentiality, integrity, and availability.

Google Chrome desktop browsers running versions older than 154.0.8037.57. Any user with Bluetooth enabled who visits a malicious web page may be impacted.

Chromium labels the issue as low severity, but the CVSS score of 8.4 indicates a high severity vulnerability; the EPSS score is < 1%, and it is not listed in the CISA KEV catalog, indicating a modest exploitation risk. The attack vector is a remote crafted HTML page that a user must visit, implying social engineering is required. Because the vulnerability involves uninitialized variables, exploitation would need the browser to execute the page’s Bluetooth code before cleanup, potentially granting privileged actions. No public exploits have been reported, and the EPSS score indicates a modest likelihood of exploitation, but the true probability remains uncertain.