CVE-2026-13903
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile — higher than 22% of all known CVEs
Summary
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. The vulnerability stems from inadequate security policy enforcement for Bluetooth functionality.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to Bluetooth features, potentially leading to data confidentiality and integrity breaches as well as privilege escalation within the browser context.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)