CVE-2026-106314 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the Bluetooth subsystem of Google Chrome versions prior to 155.0.8059.39 represents a significant breach in access control mechanisms designed to protect user privacy and system integrity. This issue stems from a failure in the browser's implementation of security policies governing interactions with local hardware interfaces, specifically those related to Bluetooth Low Energy (BLE) or classic Bluetooth protocols. In modern web applications, accessing peripheral devices such as fitness trackers, smart home sensors, or input peripherals requires explicit user consent and strict adherence to origin-based isolation principles. The flaw allowed a remote attacker to bypass these authorization checks by crafting a malicious HTML page that exploited the browser's handling of device discovery and connection requests. By leveraging this misconfiguration, an adversary could initiate unauthorized communication channels with nearby Bluetooth devices without triggering the expected permission prompts or failing due to insufficient privileges, effectively circumventing the sandboxing protections intended to isolate web content from local system resources.
From a technical perspective, this vulnerability aligns closely with CWE-284, which describes Improper Access Control, and specifically relates to scenarios where authorization checks are either missing or incorrectly implemented during critical operations. The attack vector involves social engineering combined with technical exploitation, as the victim must visit a specially crafted webpage that triggers the vulnerable code path within the Chromium engine. Once executed, the malicious script can enumerate available Bluetooth devices in the vicinity of the user's device and potentially extract sensitive data transmitted over these connections or interact with paired peripherals to perform actions not intended by the user. This capability transforms what should be a protected local interface into an attack surface accessible from the untrusted web environment, violating the principle of least privilege that underpins secure software architecture.
The operational impact of this vulnerability is primarily centered on privacy violations and potential data exfiltration. An attacker who successfully exploits this flaw can gain visibility into the user's physical surroundings by identifying nearby Bluetooth-enabled devices, which may reveal personal habits such as health metrics from wearable technology or location patterns inferred through beacon interactions. Furthermore, if paired with other vulnerabilities in connected peripherals, this access could lead to more severe consequences including unauthorized control of IoT devices or interception of sensitive communications. The severity is classified as medium because while it does not directly allow for arbitrary code execution on the host system, it provides a foothold that can be chained with other exploits to escalate privileges or steal credentials stored in connected applications. This aligns with ATT&CK technique T1046, Network Service Discovery, where adversaries probe networks and local devices to map out potential targets for further exploitation.
Mitigation strategies focus on both immediate patching and long-term architectural improvements. The primary remediation is to update Google Chrome to version 155.0.8059.39 or later, which includes the necessary code changes to enforce strict authorization checks before allowing web pages to interact with Bluetooth APIs. Users should ensure automatic updates are enabled to receive security patches promptly as they become available. Additionally, organizations and individual users can mitigate risk by disabling unnecessary Bluetooth services when not in use, configuring browsers to block all requests for device access unless explicitly permitted on a per-site basis, and employing endpoint detection and response tools that monitor for anomalous hardware interactions originating from browser processes. Regular security audits of web applications deployed within corporate environments should also include testing for improper authorization flaws related to local resource access to prevent similar vulnerabilities in custom or third-party software solutions.