CVE-2026-113060: Google Chrome Bluetooth RCE Vulnerability

CVE-2026-113060 is a remote code execution vulnerability in Google Chrome's Bluetooth component caused by improper input validation. Attackers can exploit this flaw via crafted HTML pages to execute code within the sandbox. This article covers technical details, affected versions, security impact, and how to protect your systems.

CVE-2026-113060 Overview

CVE-2026-113060 is an improper input validation vulnerability [CWE-20] in the Bluetooth component of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47. A remote attacker can exploit the issue by serving a crafted HTML page to a victim. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. Google tracked the issue in the Chromium bug tracker as issue 514017698 and resolved it in the stable channel update for desktop.

Critical Impact
Attackers can execute arbitrary code within the Chrome renderer sandbox when a victim visits a crafted web page, providing a foothold for further sandbox escape or chained exploitation.

Affected Products

Google Chrome for Desktop versions prior to 156.0.8078.47
Chromium-based builds that incorporate the vulnerable Bluetooth component
Downstream browsers that embed the affected Chromium release

Discovery Timeline

2026-10-20 - CVE-2026-113060 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113060

Vulnerability Analysis

The vulnerability lives in Chrome's Web Bluetooth implementation. Chrome's Bluetooth component fails to properly validate input received through the Web Bluetooth API surface. An attacker who convinces a user to open a crafted HTML page can trigger the flawed validation path. The resulting behavior permits arbitrary code execution confined to the browser sandbox. While sandboxed execution limits direct host compromise, it provides a reliable primitive for chaining with a sandbox escape. Google classified the Chromium severity as Medium, but the NVD CVSS assessment places the issue in the High range because of the network attack vector and the impact to confidentiality, integrity, and availability.

Root Cause

The root cause is improper input validation [CWE-20] within the Bluetooth subsystem of Chrome. Insufficient checks on attacker-supplied input values allow unexpected states to reach downstream code. These states lead to conditions that an attacker can abuse for code execution inside the renderer or Bluetooth service process boundary.

Attack Vector

Exploitation requires only that a victim visits a crafted web page using a vulnerable Chrome build. The attack is remote and network-based, with low attack complexity and no privileges required. User interaction is limited to normal browsing activity. The vulnerability does not have a public proof-of-concept, is not listed in the CISA Known Exploited Vulnerabilities catalog, and has an EPSS probability of 0.406%. See the Chromium Issue Tracker entry 514017698 and the Google Chrome Update Notice for vendor details.

Detection Methods for CVE-2026-113060

Indicators of Compromise

Chrome processes spawning unexpected child processes shortly after a user visits an untrusted page using the Web Bluetooth API
Unusual Bluetooth adapter activity initiated by the browser without corresponding user approval dialogs
Browser renderer or utility process crashes correlated with navigation to attacker-controlled domains

Detection Strategies

Inventory Chrome installations and flag any build earlier than 156.0.8078.47 across managed endpoints
Monitor browser telemetry for anomalous use of the navigator.bluetooth API from newly observed domains
Correlate web proxy logs with Chrome crash reports to identify crafted pages that trigger renderer failures

Monitoring Recommendations

Collect Chrome version data continuously via endpoint management tooling and alert on drift from the patched baseline
Forward browser process telemetry and crash dumps to a central data lake for retrospective hunting
Enable enterprise reporting of Chrome Site Isolation and sandbox events to surface anomalous child process behavior

How to Mitigate CVE-2026-113060

Immediate Actions Required

Update Google Chrome on all desktop endpoints to version 156.0.8078.47 or later
Restart Chrome after the update to ensure the patched binaries are loaded
Audit Chromium-based browsers and embedded WebViews for updates incorporating the fix

Patch Information

Google addressed CVE-2026-113060 in the Chrome stable channel update documented in the Google Chrome Update Notice. Administrators should deploy Chrome 156.0.8078.47 or later through enterprise update channels. The underlying code change is tracked in Chromium Issue 514017698.

Workarounds

Disable the Web Bluetooth API using the DefaultWebBluetoothGuardSetting enterprise policy where business workflows do not require it
Restrict Bluetooth permissions through the WebBluetoothAllowedForUrls and WebBluetoothBlockedForUrls policies to limit exposure
Enforce browsing to trusted sites via web filtering while patches are rolled out

bash

# Configuration example: block Web Bluetooth via Chrome enterprise policy (Linux JSON)
{
  "DefaultWebBluetoothGuardSetting": 2
}
# Value 2 blocks sites from requesting access to Bluetooth devices.
# Deploy to /etc/opt/chrome/policies/managed/ on Linux endpoints.