CVE-2026-106389 in Chrome
Summary
by MITRE • 10/07/2026
Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization issue within the USB subsystem of Google Chrome prior to version 155.0.8059.39 represents a significant breach in browser-based device access controls. This flaw specifically affects how the Chromium engine handles permissions for Universal Serial Bus devices, which are commonly used for data transfer, peripheral connection, and hardware authentication. The core technical deficiency lies in the insufficient validation of authorization requests when extensions interact with USB interfaces. Normally, browsers enforce strict permission models where user consent is required before an extension can access sensitive hardware resources. However, due to this implementation error, a maliciously crafted Chrome extension could circumvent these standard security checks. This bypass allows the extension to establish communication channels with connected USB devices without proper user acknowledgment or system-level restrictions being enforced effectively.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics for exploitation. Since the attack vector requires the installation and execution of a malicious Chrome extension, it does not constitute a fully remote exploit in the traditional sense where code executes solely through web page interaction without user action. Instead, an attacker must deceive a victim into installing a seemingly legitimate or benign-looking extension that contains hidden payloads designed to abuse the USB authorization flaw. Once installed, this crafted extension can leverage the incorrect authorization logic to access connected USB devices such as smart cards, hardware security keys, storage drives, or other peripherals. This unauthorized access could lead to data exfiltration from secure tokens, interception of authentication credentials stored on hardware devices, or even physical control over peripheral functions if the device supports command execution capabilities.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically regarding the failure to enforce required permissions for system resources. It also relates closely to CWE-749, which covers Exposure of Sensitive Information to an Unauthorized Actor, as the unauthorized access may reveal sensitive data stored on or transmitted through USB devices. In terms of adversary tactics, this scenario maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, via browser extensions, and potentially T1203, Exploitation for Client Execution, if the extension triggers further malicious activities post-installation. The medium severity rating assigned by Chromium reflects the balance between the potential impact of data theft or device compromise and the high level of user interaction required to initiate the attack.
Mitigation strategies must focus on both immediate remediation and long-term security hygiene. The primary defense is to update Google Chrome to version 155.0.8059.39 or later, where these authorization checks have been corrected to ensure that all USB access requests from extensions are properly validated against user permissions and system policies. Users should exercise extreme caution when installing browser extensions, verifying the publisher's reputation and reviewing requested permissions before granting consent. It is advisable to remove any unused or suspicious extensions regularly to reduce the attack surface. Additionally, organizations can implement application whitelisting solutions that restrict which Chrome extensions are permitted to run on corporate devices, thereby preventing malicious actors from leveraging this vulnerability even if they successfully trick an employee into installation. Regular security awareness training regarding social engineering techniques is also critical to prevent users from falling for deceptive extension installations that serve as the initial foothold for such attacks.