CVE-2026-14035: Chrome Bluetooth Memory Disclosure Vulnerability – CVSS 6.5

Technical summary

The vulnerability stems from insufficient policy enforcement within Chrome's Bluetooth implementation (CWE-284: Improper Access Control). The flaw allows a remote, unauthenticated attacker to bypass intended access controls and read process memory through a specially crafted HTML page. No special privileges or complex user interaction beyond visiting a website are required. The attack vector is network-based, and exploitation succeeds via low-complexity interaction: a single malicious webpage visit. Chromium's own assessment (Low) suggests the issue is contained within Bluetooth-specific functionality and may be exploitable only under certain conditions or with limited scope, though the CVSS score (6.5 MEDIUM) reflects the confidentiality impact of memory disclosure.

Business impact

Data confidentiality is the primary concern. Depending on what resides in Chrome's process memory at the time of exploitation, an attacker could potentially access sensitive user data—including login credentials, session tokens, cached personal information, or internal application data from authenticated web services. The risk is elevated in environments where users access sensitive applications via Chrome (cloud services, corporate intranet, financial platforms). Frequency of exploitation likely remains low given the need for user-initiated webpage visits, but the attack requires no special capabilities or permissions, making it accessible to moderately skilled attackers. Organizations should factor this into patching timelines for Chrome deployments.

Affected systems

The vulnerability affects Google Chrome on multiple operating systems: Windows, macOS, and Linux. All Chrome installations prior to version 150.0.7871.47 are vulnerable. The underlying operating systems (Windows, macOS, and Linux kernel) are listed as affected vendors/products in the source data, likely because Chrome's Bluetooth stack may interact with OS-level Bluetooth drivers or services, though the primary vulnerability resides in Chrome's implementation. Users on any mainstream OS running vulnerable Chrome versions should prioritize patching.

Exploitability

Exploitability is straightforward. An attacker needs only to craft a malicious HTML page and convince a user to visit it—no complex social engineering, no zero-day chain, no elevated privileges required. The attack surface is broad because it relies on web browsing, a universal behavior. However, exploitation is not automated or wormable; each victim must visit the attacker's webpage. The Bluetooth-specific nature of the vulnerability may limit which data is accessible (only data present in Bluetooth-related memory regions), which likely explains Chromium's Low severity rating despite the CVSS score. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting active in-the-wild exploitation has not yet been documented at scale.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism should deploy this patch automatically for most users, but manual verification is recommended in corporate environments. Verify the Chrome version by navigating to chrome://settings/help. For macOS and Linux users, ensure system package managers or Chrome's built-in updater have completed the update. No workarounds exist short of patching or disabling Chrome; users cannot mitigate this through browser settings alone.

Patch guidance

Prioritize patching Chrome across all endpoints within 2–3 weeks, sooner if users access high-value applications (banking, email, VPN, cloud storage). Verify successful deployment by spot-checking client versions through Mobile Device Management (MDM) tools or by reviewing browser version reports in endpoint security platforms. For organizations using Chrome Enterprise, deploy via policy to enforce rapid rollout. Test in a staging environment first if internal web applications have historically had compatibility issues with new Chrome releases, though this patch addresses a security issue and not browser APIs. No rollback is necessary unless a subsequent regression is identified; the patch is low-risk.

Detection guidance

Detection of active exploitation would require network-based indicators (malicious HTML pages hosting the attack) or behavioral analysis. Monitor for unusual memory access patterns within Chrome processes using endpoint detection and response (EDR) tools, though false positives are likely given Chrome's normal memory operations. More practically, focus on ensuring all Chrome instances are updated to 150.0.7871.47 or later; post-patch, the vulnerability is closed. If forensics are required after a suspected breach, analyze browser history and network logs for visits to untrusted domains around the time of data exfiltration. No specific log signatures are available for this vulnerability class.

Why prioritize this

Despite Chromium's Low severity rating, this vulnerability merits near-term patching because: (1) the attack is easy to execute (network-based, low-complexity interaction); (2) Chrome's ubiquity means millions of endpoints are exposed; (3) data confidentiality impact is significant if sensitive information is in memory; and (4) no exploited-in-the-wild status yet means organizations have a window to patch before opportunistic attackers weaponize it. Schedule patching within the next 2–3 weeks rather than delaying to the next regular patch window.

Risk score, explained

The CVSS 6.5 MEDIUM score reflects a high-impact confidentiality issue (memory disclosure, C:H) that is easy to trigger (network vector, no authentication, low complexity, user interaction required). The score appropriately weights the threat despite Chromium's Low internal severity rating, which likely reflects scope limitations (Bluetooth-specific) or observed real-world constraints. An organization's internal risk rating should also factor in: user base size, whether Chrome is the primary browser, exposure to untrusted websites, and whether sensitive data is routinely cached in memory (login sessions, API tokens, etc.).

Frequently asked questions