CVE-2026-14036

Low watch CVSS 8.8 chrome Policy Bypass 🔧 Commit mapped

Overview

Low

Severity

8.8

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInsufficient policy enforcement in Bluetooth

DescriptionInsufficient policy enforcement in Bluetooth

ComponentBluetooth

Bug ClassPolicy Bypass

Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Tracker496411061

Fix commit8b64a2a0d89e (chromium/src) +29/-1

CWECWE-602

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedGoogle

Reported2026-03-26 (per vendor advisory)

Fix landed2026-05-08 (public git)

Disclosed2026-06-30

Patch gap53 days — fix public in source before the advisory

Background

Web Bluetooth blocklist: BluetoothBlocklist, a browser-process allow/deny policy that marks certain GATT characteristic UUIDs with restrictions such as EXCLUDE_READS.
`EXCLUDE_READS`: a blocklist value meaning all read operations on a characteristic must be blocked, which per the Web Bluetooth spec includes startNotifications().
`startNotifications()`: a Web Bluetooth API that subscribes to value-change notifications/indications for a GATT characteristic, plumbed to WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications in the browser.
`IsExcludedFromReads()`: the BluetoothBlocklist query that reports whether a given UUID is marked EXCLUDE_READS.

Root Cause Analysis

Standard Web Bluetooth read requests consult BluetoothBlocklist and reject characteristics marked EXCLUDE_READS, but WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications performed no such check even though subscribing to notifications is semantically a read and can leak the characteristic’s value. A site could therefore call startNotifications() on a read-blocklisted characteristic and receive its value changes, bypassing the EXCLUDE_READS policy entirely.

The fix inserts a check that calls BluetoothBlocklist::Get().IsExcludedFromReads() on query_result.characteristic->GetUUID(); when excluded it records UMAGATTOperationOutcome::kBlocklisted, runs the callback with WebBluetoothResult::BLOCKLISTED_READ, and returns before establishing any notify/indicate session. This restores the invariant that read-blocklisted characteristics cannot be read through any path, including notifications.

Key insight

The blocklist was enforced only on the explicit read path, not on the notification-subscription path that also exposes characteristic values; the fix adds the missing IsExcludedFromReads() gate to RemoteCharacteristicStartNotifications, tightening the check.

Attack Path

Target a read-blocklisted characteristic A malicious site connects (with existing Web Bluetooth permission) to a device exposing a GATT characteristic whose UUID is marked EXCLUDE_READS.
Attempt a direct read (blocked) A normal read is rejected because the read path already consults the blocklist.
Pivot to notifications The site instead calls startNotifications(), reaching RemoteCharacteristicStartNotifications, which pre-patch skipped the blocklist check and set up a notify/indicate session.
Exfiltrate values As the characteristic’s value changes, notifications deliver those values to the page, achieving the read the EXCLUDE_READS policy was meant to forbid.

Impact Assessment

A web page with Web Bluetooth access gains the ability to read the value of a characteristic that policy marked read-excluded, by subscribing to notifications instead of reading directly, defeating the EXCLUDE_READS protection in the browser process. Preconditions are an established device connection and a characteristic blocklisted with EXCLUDE_READS. The advisory rates this as insufficient policy enforcement in Bluetooth; no exploited-in-the-wild status is stated and no memory-safety impact is involved.

Changed Functions

Function	Change	Notes
`TEST_F` content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc	modified

Files Changed

content/browser/bluetooth/web_bluetooth_service_impl.cc
content/browser/bluetooth/web_bluetooth_service_impl.h
content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc

Audit Directions

Read-equivalent operations
Identify every API that exposes a characteristic/attribute value (reads, notifications, indications, descriptor reads) and confirm each applies the same blocklist/read policy.
Policy checks duplicated per entry point
Where a policy is enforced by ad-hoc checks scattered across handlers rather than a single choke point, audit each handler for the missing check.
Spec-mandated equivalences
Cross-reference spec statements like “notifications count as reads” against the implementation to find paths that ignore the equivalence.

Patch

view commit

From 8b64a2a0d89ec6639385e6fea61c4c204a7ed3d7 Mon Sep 17 00:00:00 2001
From: Rob Pitkin <robpitkin@google.com>
Date: Thu, 07 May 2026 17:19:04 -0700
Subject: [PATCH] Web Bluetooth: Fix EXCLUDE_READS blocklist bypass in startNotifications

The Web Bluetooth specification dictates that if a characteristic's UUID
is blocklisted with EXCLUDE_READS, all read operations — including
startNotifications() — must be blocked.

While standard read requests check the blocklist,
WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications lacked
this check. This allowed a malicious site to bypass the read restriction
by subscribing to notifications.

This change adds the missing check.

This change will block `startNotifications()` calls on characteristics
marked as `EXCLUDE_READS`. This might break existing web applications
that were relying on this unintended bypass.

Bug: 496411061
Change-Id: I3bd8ab14f948230e6543acde20d9f1adfdcf2df8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7823004
Reviewed-by: Matt Reynolds <mattreynolds@chromium.org>
Commit-Queue: Rob Pitkin <robpitkin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1627359}
---

diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.cc b/content/browser/bluetooth/web_bluetooth_service_impl.cc
index 9a8a4ff1..a075173 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -1308,6 +1308,13 @@
     return;
   }
 
+  if (BluetoothBlocklist::Get().IsExcludedFromReads(
+          query_result.characteristic->GetUUID())) {
+    RecordStartNotificationsOutcome(UMAGATTOperationOutcome::kBlocklisted);
+    std::move(callback).Run(blink::mojom::WebBluetoothResult::BLOCKLISTED_READ);
+    return;
+  }
+
   BluetoothRemoteGattCharacteristic::Properties notify_or_indicate =
       query_result.characteristic->GetProperties() &
       (BluetoothRemoteGattCharacteristic::PROPERTY_NOTIFY |
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.h b/content/browser/bluetooth/web_bluetooth_service_impl.h
index 3798fb0..c414992 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.h
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.h
@@ -157,6 +157,8 @@
                            NoShowBluetoothScanningPromptInPrerendering);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            DeferredStartNotifySession);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           StartNotificationsBlocklisted);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest, DeviceDisconnected);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            DeviceGattServicesDiscoveryTimeout);
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 309c147..42523def 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -10,14 +10,15 @@
 #include <vector>
 
 #include "base/memory/raw_ptr.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/test/bind.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/test/mock_callback.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/test_future.h"
 #include "content/browser/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "content/browser/bluetooth/bluetooth_allowed_devices.h"
+#include "content/browser/bluetooth/bluetooth_blocklist.h"
 #include "content/browser/bluetooth/web_bluetooth_pairing_manager.h"
 #include "content/public/browser/bluetooth_delegate.h"
 #include "content/public/common/content_client.h"
@@ -1032,6 +1033,24 @@
   }
 }
 
+TEST_F(WebBluetoothServiceImplTest, StartNotificationsBlocklisted) {
+  RegisterTestCharacteristic();
+  FakeBluetoothCharacteristic& test_characteristic =
+      battery_device_bundle().characteristic();
+
+  BluetoothBlocklist::Get().Add(test_characteristic.GetUUID(),
+                                BluetoothBlocklist::Value::EXCLUDE_READS);
+
+  base::test::TestFuture<WebBluetoothResult> future;
+  service_ptr_->RemoteCharacteristicStartNotifications(
+      test_characteristic.GetIdentifier(),
+      BindCharacteristicClientAndPassRemote(), future.GetCallback());
+
+  EXPECT_EQ(future.Get(), WebBluetoothResult::BLOCKLISTED_READ);
+
+  BluetoothBlocklist::Get().ResetToDefaultValuesForTest();
+}
+
 TEST_F(WebBluetoothServiceImplTest, DeviceGattServicesDiscoveryTimeout) {
   const auto battery_device_id = AddTestDevice(battery_device_bundle());

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 309c147..42523def 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -10,14 +10,15 @@
 #include <vector>
 
 #include "base/memory/raw_ptr.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/test/bind.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/test/mock_callback.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/test_future.h"
 #include "content/browser/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "content/browser/bluetooth/bluetooth_allowed_devices.h"
+#include "content/browser/bluetooth/bluetooth_blocklist.h"
 #include "content/browser/bluetooth/web_bluetooth_pairing_manager.h"
 #include "content/public/browser/bluetooth_delegate.h"
 #include "content/public/common/content_client.h"
@@ -1032,6 +1033,24 @@
   }
 }
 
+TEST_F(WebBluetoothServiceImplTest, StartNotificationsBlocklisted) {
+  RegisterTestCharacteristic();
+  FakeBluetoothCharacteristic& test_characteristic =
+      battery_device_bundle().characteristic();
+
+  BluetoothBlocklist::Get().Add(test_characteristic.GetUUID(),
+                                BluetoothBlocklist::Value::EXCLUDE_READS);
+
+  base::test::TestFuture<WebBluetoothResult> future;
+  service_ptr_->RemoteCharacteristicStartNotifications(
+      test_characteristic.GetIdentifier(),
+      BindCharacteristicClientAndPassRemote(), future.GetCallback());
+
+  EXPECT_EQ(future.Get(), WebBluetoothResult::BLOCKLISTED_READ);
+
+  BluetoothBlocklist::Get().ResetToDefaultValuesForTest();
+}
+
 TEST_F(WebBluetoothServiceImplTest, DeviceGattServicesDiscoveryTimeout) {
   const auto battery_device_id = AddTestDevice(battery_device_bundle());

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD

On This Page