This vulnerability in Google Chrome's Bluetooth implementation prior to version 151.0.7922.72 involves insufficient enforcement of security policies, specifically allowing a remote attacker with control over the renderer process to bypass the same origin policy through a specially crafted HTML page. The same origin policy is a critical browser security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized actions or data manipulation within the browser context. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker who has already compromised the renderer process to bypass the same origin policy, potentially enabling unauthorized modification of data or actions within the browser. There is no direct confidentiality impact, and availability is unaffected. The integrity of browser operations can be compromised, which may facilitate further attacks or data manipulation within the affected browser session.

The vendor advisory linked does not explicitly state patch availability or remediation instructions. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.