CVE-2026-13903: Chrome Bluetooth Privilege Escalation – CVSS 8.8 HIGH – Patch to 150.0.7871.47

Technical summary

CVE-2026-13903 is an insufficient policy enforcement flaw (CWE-602) in Chrome's Bluetooth implementation. The vulnerability stems from inadequate validation or enforcement of Bluetooth-related policies before granting permission escalation. The attack surface is the renderer process handling untrusted HTML content; a crafted page can trigger the privilege escalation without requiring the user to explicitly grant additional permissions beyond visiting the site. The CVSS 3.1 score of 8.8 (HIGH) reflects network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses a significant risk to enterprises relying on Chrome for both managed and unmanaged endpoints. Successful exploitation allows attackers to gain elevated privileges on affected machines, potentially enabling lateral movement, data exfiltration, installation of persistent malware, or system compromise. The requirement for user interaction (visiting a malicious page) makes this a practical attack vector in spear-phishing and drive-by compromise scenarios. Organizations with strict Bluetooth policies may face additional risk if users are tricked into visiting attacker-controlled sites.

Affected systems

All Google Chrome installations prior to version 150.0.7871.47 are affected. This includes Chrome on Windows, macOS, Linux, and potentially Chrome OS depending on the patched version release schedule. Users should verify their current Chrome version against the fixed build to determine exposure. No other vendors or products are affected based on available information.

Exploitability

This vulnerability is moderately difficult to exploit at scale but practical for targeted attacks. The attacker must craft a malicious HTML page and convince a user to visit it—no zero-click attack or browser plugin requirement. Once a user lands on the page, the exploit executes automatically. The low attack complexity and network accessibility make this suitable for phishing campaigns or watering-hole attacks. As of the publication date, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting either recent disclosure or limited active exploitation—organizations should not assume absence from KEV equals low real-world risk.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism typically deploys patches within days, but users should manually verify the update in Settings > About Chrome to accelerate patching. Organizations using Chrome enterprise policies should verify that auto-updates are enabled and test patch deployment in a non-production environment first to avoid compatibility issues. No workarounds exist beyond updating.

Patch guidance

Verify your current Chrome version by navigating to Settings > About Chrome; the browser will display installed version and check for updates automatically. Once the update to 150.0.7871.47 or later is installed, Chrome will automatically restart to apply the patch. For enterprise deployments, admins can verify patch status via Chrome Enterprise policy reporting and leverage UpdatesSuppressed policies if staged rollouts are required. Test the patched version against critical web applications to ensure no regressions before full deployment.

Detection guidance

Endpoints should be inventoried for Chrome versions pre-150.0.7871.47. On Windows, check HKEY_CURRENT_USER\Software\Google\Chrome\BrowserMetrics for version data or query the application directly via command line (google-chrome --version). Network-based detection is challenging because the attack is HTTP/HTTPS-based HTML delivery; however, organizations can monitor for suspicious Bluetooth permission prompts or unexpected Bluetooth access on sensitive workstations. EDR tools should flag privilege escalation events originating from Chrome processes, particularly when combined with Bluetooth subsystem access. Additionally, log for user visits to newly registered or suspicious domains that might host exploit pages.

Why prioritize this

Despite Chromium's internal assessment of Medium severity, the CVSS 3.1 score of 8.8 (HIGH) and the practical nature of the attack vector justify immediate prioritization. Privilege escalation on user workstations is a critical risk; successful exploitation enables attackers to bypass security controls, access sensitive data, and establish persistence. The low barrier to exploitation (crafted HTML page via phishing) and the ubiquity of Chrome in both enterprise and consumer environments amplify business risk. Organizations should prioritize patching alongside other critical infrastructure updates.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible vulnerability with low attack complexity, no privilege requirements, and high impact across all three security properties (C, I, A). The 'UI:R' component (user interaction required) is the primary limiting factor, preventing a perfect 9.0+ score. However, the practical ease of social engineering—email with a link to a malicious page—makes this constraint less protective in real-world scenarios. The scope is unchanged (S:U), meaning the privilege escalation is contained to the user's local system but sufficient to compromise it fully.

Frequently asked questions