This vulnerability involves insufficient policy enforcement in the Bluetooth component of Google Chrome before version 150.0.7871.47. An attacker can exploit this flaw by delivering a specially crafted HTML page that triggers privilege escalation. The issue is tracked as CWE-602 (Insufficient Control of Object Lifecycle) and has been assigned CVE-2026-13903. Although the CVSS score indicates high severity, there is no explicit vendor advisory stating a patch or fix availability. The official Google Chrome stable channel update blog is referenced but does not explicitly confirm remediation status.

Successful exploitation could allow a remote attacker to escalate privileges on the affected system via Bluetooth policy enforcement weaknesses in Chrome. This could lead to full compromise of the user's browser context and potentially the underlying system depending on privilege levels. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites, especially those that might leverage Bluetooth functionality. Monitor for updates from Google Chrome and apply them promptly once available.