CVE-2026-113131

Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113131

Google Chrome versions prior to 156.0.8078.47 are vulnerable to a memory corruption flaw within the Bluetooth component. A remote attacker can exploit this vulnerability by using a crafted HTML page to achieve arbitrary code execution inside the sandbox. The vulnerability is categorized as a CWE-...

CVE-2026-113131

Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113310

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113310

An out-of-bounds read vulnerability exists in the Bluetooth component of Google Chrome (specifically within chromium-browser ) prior to version 156.0.8078.47 . A remote attacker can exploit this flaw by enticing a user to view a crafted HTML page , which allows the attacker to read memory inside ...

CVE-2026-113310

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

A flaw was found in the Bluetooth hcisync component of the Linux kernel. When the hcidevclosesync function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCICMDDRAINWORKQUEUE flag is not properly set, which can lead to system instability or a...

kernel: Bluetooth: hci_sync: Fix advertising data UAFs

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hcisync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free UAF vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly durin...

system_bt_AOSP10_r33_CVE-2020-0471

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

BadBlue

BadBlue Windows CVE-2024-21306 BadBlue implementation Using DuckyScript Unauthenticated Peering Leading to Code Execution Using HID Keyboard This is an implementation of the CVE discovered by marcnewlin And some code from BlueDucky Introduction BadBlue is a powerful tool for exploiting a...

CVE-2026-93209

A flaw was found in the Linux kernel's Bluetooth subsystem. Under conditions of memory pressure, a function responsible for handling Bluetooth commands can fail to properly track command completion. This can lead to intermittent failures when enabling Bluetooth, resulting in a denial of service...

CVE-2026-98601

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. The driver fails to validate index values provided by the hardware device through Direct Memory Access DMA. A malicious or compromised PCIe device could supply out-of-range indices to trigger an out-of-bounds memory dereference o...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2026-6992-PoC

CVE-2026-6992-PoC Vulnerability proof of concept for the bluetooth pin RCE injection CVE-2026-6992 reworked from https://github.com/utmost3/cve/issues/2 I take no credit for discovering the vulnerability. This is for educational and portfolio purposes only. For devices that do not have management...

Learn.BlueJam

BlueJam KNOB Attack With KNOB your Bluetooth speakers can be monitored for iPhone and Android use. The first way you can do this is to step up the KNOB attack. The second is to let the KNOB attack decrypt or weaken Bluetooth traffic between the two devices. By doing this, you will have an...

CVE-2026-80914

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. A use-after-free vulnerability can occur in the isoconnready function if a listener socket is closed concurrently while a child socket is being created. This can lead to a dangling pointer being dereferenced upon a later...

RustyInjector

⚠️ Disclaimer: For Research and Educational Purposes Only This project is a Proof of Concept PoC demonstrating Bluetooth keystroke injection, re-implemented in Rust. It is intended strictly for educational and security research purposes. Do not use this code to compromise systems without explicit...

CVE-2023-23388

This repository contains a poc for CVE-2023-23388, which is described in this series, particularly in this post. It's an LPE in the bluetooth service aka bthserv in Windows 10/11 that allows an unprivileged user to escalate to LOCAL SERVICE. This repo doesn't contain an exploit, only a poc...

buds-audit

buds-audit Version 1.0.0 Bluetooth security assessment tool for wireless earbuds affected by the Airoha SDK vulnerability chain CVE-2025-20700 / CVE-2025-20701 / CVE-2025-20702. Scans for nearby devices, fingerprints known-affected Airoha-based chipsets, and probes for unauthenticated GATT access...

system_bt_AOSP10_r33_CVE-2020-0377

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...