{"id":"CVE-2026-113310","kind":"vulnerability","aliases":["CVE-2026-113310"],"related":[],"title":"Google Chrome: Bluetooth out-of-bounds read leaks sandbox memory via crafted page","description":"Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A flaw in Chrome's Bluetooth code lets a crafted HTML page read memory outside an intended buffer, but only inside the browser sandbox. An attacker gets information from the browser process memory space, not direct code execution from the page alone.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","chrome","desktop","managed-fleet","package"],"not_affected_if":["chrome-updated","no-chrome-installed"],"how_to_check":"- Run `chrome://version` in Google Chrome and compare the version with `156.0.8078.47`\n- On managed fleets, check the installed Chrome version reported by the device management console","fix":"- Update Google Chrome to `156.0.8078.47` or later\n- Relaunch the browser after the update so the fixed build is running","status":"open","published_at":"2026-10-20T22:19:25+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-25T03:52:54+00:00","updated_at":"2026-10-25T03:52:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:52:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome to `156.0.8078.47` or later\n- Relaunch the browser after the update so the fixed build is running","reach":"internet","title":"Google Chrome: Bluetooth out-of-bounds read leaks sandbox memory via crafted page","impact":"low","summary":"A flaw in Chrome's Bluetooth code lets a crafted HTML page read memory outside an intended buffer, but only inside the browser sandbox. An attacker gets information from the browser process memory space, not direct code execution from the page alone.","category":"package","nicknames":[],"who_cares":["chrome","browser","desktop","managed-fleet"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads memory inside the browser sandbox from a crafted page","analyst_note":"","how_to_check":"- Run `chrome://version` in Google Chrome and compare the version with `156.0.8078.47`\n- On managed fleets, check the installed Chrome version reported by the device management console","needs_analyst":false,"not_affected_if":["chrome-updated","no-chrome-installed"],"who_is_affected":"Any machine running Google Chrome before `156.0.8078.47` is exposed when a user visits an attacker-controlled page. Teams that only use Chrome on managed fleets with automatic updates are usually patched quickly, and servers without a browser are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3335,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113310':17A,20A '-2026':16A,19A '156.0.8078.47':83C 'allow':84C 'alon':71B 'attack':55B,87C 'bluetooth':3A,35B,77C 'bound':7A,74C 'browser':23B,52B,60B 'buffer':47B 'chrome':2A,22A,24B,33B,80C 'chromium':99C 'code':36B,66B 'craft':13A,39B,96C 'cve':15A,18A 'desktop':25B 'direct':65B 'execut':67B 'flaw':31B 'fleet':28B 'get':56B 'googl':1A,79C 'google':21A 'high':102C 'html':40B,97C 'inform':57B 'insid':50B,91C 'intend':46B 'leak':9A 'let':37B 'manag':27B 'managed-fleet':26B 'memori':11A,43B,62B,90C 'out-of-bound':4A 'outsid':44B 'packag':29B 'page':14A,41B,70B,98C 'prior':81C 'process':61B 'read':8A,42B,75C,89C 'remot':86C 'sandbox':10A,53B,93C 'secur':100C 'sever':101C 'space':63B 'via':12A,94C","nicknames":[],"mitigations":[],"who_affected":"Any machine running Google Chrome before `156.0.8078.47` is exposed when a user visits an attacker-controlled page. Teams that only use Chrome on managed fleets with automatic updates are usually patched quickly, and servers without a browser are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113310","severity":null,"published_at":"2026-10-20T22:19:25+00:00","modified_at":"2026-10-21T17:05:35+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}