This vulnerability involves insufficient validation of untrusted input in the Bluetooth functionality of Google Chrome versions before 151.0.7922.72. An attacker who has compromised the renderer process could exploit this flaw by delivering a specially crafted HTML page, potentially enabling sandbox escape. The sandbox escape could allow the attacker to execute code outside the restricted environment of the renderer process. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L). No known exploits in the wild have been reported. The vendor has published a stable channel update addressing this issue in version 151.0.7922.72.

Successful exploitation could allow an attacker with control over the renderer process to escape the sandbox, potentially leading to limited code execution outside the sandbox. The impact includes partial confidentiality, integrity, and availability loss. However, exploitation requires prior compromise of the renderer process and user interaction, reducing the overall risk.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides official update guidance.