CVE-2026-14119: Chrome Bluetooth Information Disclosure

CVE-2026-14119 Overview

CVE-2026-14119 is a type confusion vulnerability [CWE-843] in the Bluetooth component of Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.47. An attacker on the local network segment can exploit the issue using a malicious Bluetooth peripheral to obtain sensitive information from the Chrome process memory. Google classifies the Chromium security severity as Low, while the NVD assigns a CVSS 3.1 score of 6.5. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
A malicious Bluetooth peripheral within radio range can trigger type confusion in Chrome's Bluetooth stack and read potentially sensitive data from browser process memory.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows hosts running vulnerable Chrome builds
Chromium-based browsers sharing the affected Bluetooth code paths

Discovery Timeline

2026-06-30 - CVE-2026-14119 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14119

Vulnerability Analysis

The vulnerability resides in Chrome's Web Bluetooth implementation on Windows. Chrome incorrectly interprets a memory object as a type different from its actual type when processing responses from a Bluetooth peripheral. This type confusion allows the browser to operate on structured fields using an incorrect layout, producing an out-of-bounds view of adjacent process memory.

Because the confused object is read rather than executed against, the primary consequence is disclosure of process memory rather than code execution. Leaked memory may contain page contents, cookies, tokens, or other Bluetooth session state held by the renderer or browser process.

The attack requires adjacent network access, meaning the attacker must be within Bluetooth radio range of the target. No authentication or user interaction is required once the victim's browser initiates or accepts communication with the malicious peripheral.

Root Cause

The root cause is a type confusion condition [CWE-843] in the Bluetooth code path. The affected function accepts data from an untrusted peripheral without validating that the received payload matches the expected type. Chrome then dereferences fields assuming a different structure, exposing bytes that belong to unrelated objects.

Attack Vector

An attacker operates a malicious Bluetooth Low Energy (BLE) peripheral on the local network segment. When a Chrome user pairs with or receives advertisements from the peripheral, the device returns crafted responses that trigger the type confusion. The attacker retrieves leaked bytes through subsequent Bluetooth exchanges. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-14119

Indicators of Compromise

Chrome browser versions on Windows below 150.0.7871.47 remaining in production use
Unexpected Bluetooth pairing attempts from unknown peripherals near managed endpoints
Chrome renderer or browser process crashes referencing Bluetooth device modules

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build earlier than 150.0.7871.47
Monitor Windows event logs for BthServ and Bluetooth stack anomalies coinciding with Chrome activity
Correlate Chrome crash telemetry with Bluetooth device connection events on the same host

Monitoring Recommendations

Enable browser version telemetry through endpoint management tooling and alert on out-of-date installations
Log Bluetooth pairing and advertisement scanning activity on corporate laptops
Track outbound network activity from Chrome processes following Bluetooth sessions to detect exfiltration of leaked data

How to Mitigate CVE-2026-14119

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 150.0.7871.47 or later
Restart the browser after patching to ensure the new binary is loaded into memory
Verify the deployed version through chrome://settings/help or centralized software inventory

Patch Information

Google addressed the issue in the Chrome Stable channel release referenced in the Google Chrome Stable Update advisory. Chrome versions 150.0.7871.47 and later contain the corrected Bluetooth type handling. Enterprise administrators should deploy the fixed build through their standard patch management workflow.

Workarounds

Disable Web Bluetooth via the DefaultWebBluetoothGuardSetting enterprise policy set to 2 on managed Chrome installations
Turn off the Bluetooth radio on Windows endpoints that do not require Bluetooth peripherals
Restrict physical access to sensitive workstations to reduce exposure to attacker-controlled peripherals within radio range

bash

# Configuration example - disable Web Bluetooth via Chrome enterprise policy on Windows
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultWebBluetoothGuardSetting /t REG_DWORD /d 2 /f