CVE-2026-95326 in Chrome
Summary
by MITRE • 09/29/2026
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an incomplete cleanup issue within the Bluetooth subsystem of Google Chrome prior to version 154.0.8037.57 represents a state management flaw that can lead to unauthorized access scenarios. This defect occurs when the browser fails to properly release or reset internal resources and permissions associated with Bluetooth interfaces after they are no longer in active use or upon page navigation events. In web security, such incomplete cleanup often results in lingering states where previous permission grants or connection contexts remain valid even after the user intends to revoke them or move away from the requesting context. This behavior deviates from expected secure coding practices which mandate strict lifecycle management of sensitive hardware interfaces to prevent state leakage between different browsing sessions or tabs.
From a technical perspective, this flaw allows for potential privilege escalation within the browser's sandboxed environment. By leveraging social engineering techniques, an attacker can craft a malicious HTML page that interacts with the Web Bluetooth API. The crafted script may initiate a connection request and then rely on the incomplete cleanup mechanism to maintain access or retain sensitive data from previous interactions without requiring explicit user consent for subsequent actions. This effectively bypasses system access restrictions because the browser continues to treat the application as having legitimate, active permission despite the context being compromised or abandoned by the user. The severity is classified as low in Chromium security metrics, indicating that while the mechanism exists and can be exploited, it may require specific conditions or limited scope of impact compared to critical remote code execution vulnerabilities.
The operational impact centers on privacy violations and potential unauthorized control over local hardware peripherals. An attacker who successfully exploits this vulnerability could potentially read data from paired Bluetooth devices such as fitness trackers, smart home sensors, or input devices without the user's ongoing awareness or consent. This undermines the principle of least privilege by allowing applications to retain access beyond their intended lifespan. Furthermore, it poses a risk to session integrity, where an attacker might use residual connections to intercept communications or inject commands into connected peripherals if those devices do not implement robust authentication mechanisms themselves. The reliance on social engineering means that direct remote exploitation is unlikely; instead, the victim must be tricked into visiting a malicious site and granting initial Bluetooth permissions, after which the vulnerability allows for persistent or expanded access beyond what was originally intended.
Mitigation strategies primarily involve updating to Google Chrome version 154.0.8037.57 or later, where this incomplete cleanup logic has been corrected to ensure proper resource deallocation and state reset upon context termination. Users should also adhere to best practices by regularly reviewing Bluetooth permissions granted to websites through the browser settings interface and revoking access for any sites that are no longer trusted. Additionally, enabling strict site isolation features can help limit the blast radius of such vulnerabilities by ensuring that data from one origin cannot be accessed by another, even if internal state management fails. Security awareness training remains crucial as social engineering is a prerequisite vector; users should exercise caution when granting hardware access permissions to unfamiliar domains and monitor for unexpected behavior in connected devices after visiting new websites.
This vulnerability aligns with CWE-401, which describes the missing release of memory or other resources leading to resource exhaustion or state inconsistency, although here it manifests as an authorization bypass rather than a denial of service. In terms of attack patterns, this scenario relates to ATT&CK technique T1562, specifically Impair Defenses through Disable or Modify Tools, but more accurately fits within the broader category of privilege escalation via improper access control mechanisms. The exploitation path involves Initial Access through social engineering followed by Privilege Escalation due to flawed state management in the browser's security model. Understanding these mappings helps security teams prioritize patching and configure endpoint detection rules that monitor for unusual Bluetooth API usage patterns indicative of such abuse.