PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17986 Google CVE debrief

CVE-2026-17986 debrief: Google Chrome Bluetooth policy enforcement insufficient. Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. This vulnerability affects Google Chrome deployments, particularly those using Bluetooth features. Defenders should assess exposure and prioritize updating Chrome to version 151.0.7922.72 or later. The CVE record was published on 2026-07-30T01:17:03.210Z and has not been modified since then. Evidence from official CVE and NVD records indicate insufficient policy enforcement in Google Chrome's ...

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for Google Chrome deployments, particularly those using Bluetooth features, should assess exposure and prioritize updating Chrome to version 151.0.7922.72 or later.

Why it matters

CVE-2026-17986 is a medium-severity vulnerability in Google Chrome's Bluetooth feature. Insufficient policy enforcement allows remote attackers who have compromised the renderer process to bypass same origin policy via crafted HTML pages. Defenders should prioritize verifying and applying Chrome updates to version 151.0.7922.72 or later. Exposure and potential impact require verification from official Chrome sources.

  • Remote attackers may bypass same origin policy restrictions
  • Compromised renderer processes could lead to unauthorized actions
  • Defenders must verify and apply Chrome updates to prevent exploitation
  • Exposure requires verification from official Chrome sources

Technical summary

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. This vulnerability affects Google Chrome deployments using Bluetooth features. The issue was addressed in Chrome version 151.0.7922.72 or later. Official CVE Program record and NIST NVD detail page provide additional information on this vulnerability.

Defensive priority

Defenders should prioritize verifying and applying Chrome updates to address insufficient policy enforcement in Bluetooth

Recommended defensive actions

  • Verify and apply Chrome updates to version 151.0.7922.72 or later
  • Monitor Chrome release notes and security advisories for future updates
  • Implement same origin policy checks in web applications

Evidence notes

Evidence from official CVE and NVD records indicate insufficient policy enforcement in Google Chrome's Bluetooth feature prior to version 151.0.7922.72. This allows a remote attacker who has compromised the renderer process to bypass same origin policy via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17986 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17986

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17986 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17986

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.