CVE-2026-14119: Chrome Bluetooth Type Confusion on Windows – Memory Disclosure Vulnerability

Technical summary

This vulnerability (CWE-843: Type Confusion) exists in Chrome's Bluetooth implementation on Windows. The flaw allows improper handling of type information when processing Bluetooth peripheral communications, creating a condition where memory that should be protected can be read by an unauthenticated attacker positioned on the local network segment. The attack requires crafting a malicious Bluetooth peripheral that triggers the type confusion during device enumeration or communication handshake. The CVSS v3.1 score of 6.5 (Medium) reflects a high confidentiality impact, no integrity or availability impact, adjacent network access requirement, and no privilege escalation needed.

Business impact

If an attacker establishes themselves on your corporate or office network with Bluetooth capability, they could extract sensitive data from Chrome process memory—potentially including cached credentials, authentication tokens, or unencrypted session data. This is particularly concerning in environments where employees use Chrome for sensitive web applications or where BYOD policies permit personal devices. The local-network requirement limits exposure to insider threats, adjacent-segment network attackers, or compromised devices already on the network.

Affected systems

Affected: Google Chrome on Microsoft Windows versions prior to 150.0.7871.47. The vulnerability does not affect Chrome on other operating systems (macOS, Linux, Android) or other Chromium-based browsers running on Windows unless they bundle the same vulnerable Bluetooth code path. Verify your Chrome version via chrome://version/ and check whether Bluetooth functionality is enabled in your organization's Chrome policies.

Exploitability

Exploitability is constrained by several factors: the attacker must be on the same local network segment as the target, must possess or control a Bluetooth device capable of emulating a malicious peripheral, and must have proximity to the target system. There is no indication of publicly available weaponized exploits or active exploitation in the wild (this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog). The complexity is low once an attacker is positioned, but the access requirements significantly reduce overall risk in properly segmented networks.

Remediation

Update Google Chrome on all Windows systems to version 150.0.7871.47 or later. Verify the update via chrome://version/. Consider implementing Chrome update policies that enforce automatic updates to prevent version drift. Additionally, disable Bluetooth on Chrome at the OS or network level if not required, and segregate untrusted devices or networks from corporate segments where sensitive work occurs.

Patch guidance

Chrome is typically updated automatically for most users, but verify completion on critical systems. In enterprise environments, check your Chrome policy management console or endpoint management tool (e.g., Intune, JAMF) to confirm deployment status. If manual deployment is required, download Chrome 150.0.7871.47 or later from google.com/chrome. Test the patch on a representative system before rolling out broadly to confirm compatibility with line-of-business applications. Verify using chrome://version/ that affected systems show the patched version.

Detection guidance

Monitor for Chrome processes communicating with unexpected Bluetooth devices using tools like Wireshark or your network detection and response solution; look for unusual Bluetooth HCI (Host Controller Interface) packets. Endpoint detection and response (EDR) tools may flag attempts to read Chrome process memory via debugging interfaces. Log Bluetooth device pairing events and unexpected device connections. If you have memory-dump detection capabilities, alerting on unauthorized attempts to read Chrome process memory could surface exploitation attempts. No known signatures exist at this time; detection will require behavioral anomaly monitoring.

Why prioritize this

This vulnerability merits medium-to-high priority in environments where Bluetooth is enabled, employees bring personal devices, or where the network boundary is not strictly controlled. However, it ranks below critical remotely exploitable flaws because it requires local network presence and Bluetooth hardware. Prioritize patching if your organization permits Bluetooth on Windows systems, has open WiFi networks, or operates in high-security environments (finance, healthcare, government). In air-gapped or Bluetooth-disabled environments, priority is lower but remediation should still occur within normal patching windows.

Risk score, explained

The CVSS 6.5 (Medium) score reflects the high confidentiality impact (an attacker can read sensitive memory) weighted against the adjacent-network access vector, which is more restrictive than internet-facing attack surfaces. The lack of integrity or availability impact keeps the score from reaching High. The real-world risk depends heavily on your network architecture, Bluetooth enablement policies, and the sensitivity of data typically cached in Chrome memory. Insider-threat or BYOD scenarios elevate practical risk despite the technical Medium rating.

Frequently asked questions