CVE-2026-78911 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Google Chrome prior to version 152.0.7977.65 represents a critical failure in access control mechanisms governing interactions between web content and local hardware interfaces, specifically Universal Serial Bus devices. This flaw is categorized under CWE-862, which denotes Missing Authorization, indicating that the browser failed to properly verify whether the executing script had sufficient privileges to initiate communication with USB peripherals. The security severity of this issue is rated as High by the Chromium team due to its potential for privilege escalation and sandbox escape, a scenario where an attacker breaks out of the restricted execution environment designed to isolate web content from the underlying operating system.
The technical mechanism behind this vulnerability relies on the browser's handling of USB device access requests initiated via JavaScript APIs such as WebUSB or similar interfaces. When a webpage attempts to connect to a USB device, Chrome is supposed to enforce strict authorization checks to ensure that only trusted contexts can perform these operations. However, in versions prior to the specified patch, this check was either bypassed or incorrectly implemented for certain classes of requests originating from compromised renderer processes. A renderer process is responsible for displaying web content and executing JavaScript within a sandboxed environment intended to prevent malicious code from affecting the rest of the system. By exploiting the incorrect authorization logic, an attacker could trick the browser into granting elevated permissions to scripts running inside this isolated container.
The operational impact of this vulnerability allows a remote attacker who has already compromised a renderer process through social engineering techniques, such as phishing or drive-by downloads, to execute arbitrary code outside the sandbox. This effectively breaks the fundamental security boundary that protects users from malicious web content. Once the attacker gains access to USB interfaces with improper authorization checks, they can interact directly with hardware devices connected to the user's machine. This capability enables a wide range of attacks, including data exfiltration via storage devices, keystroke logging through HID (Human Interface Device) emulators, or even physical control over peripheral functions that could disrupt system operations or steal sensitive information stored on attached drives.
From an offensive security perspective, this vulnerability aligns with the MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with lateral movement techniques like T1217, Browser Information Discovery, if the attacker uses USB devices to gather system information. Furthermore, it relates to T1083, File and Directory Discovery, as attackers may use connected storage devices to locate sensitive files on the host machine. The ability to execute code outside the sandbox places this vulnerability in a high-risk category similar to other browser-based privilege escalation flaws that have historically led to significant security breaches across major web browsers.
Mitigation for this issue requires immediate updating of Google Chrome to version 152.0.7977.65 or later, where the authorization checks for USB interactions have been corrected and hardened. Organizations should enforce automated update policies to ensure all endpoints are running patched versions promptly. Additionally, users can mitigate risk by disabling unnecessary browser extensions that interact with hardware interfaces and by exercising caution when visiting untrusted websites that request permission to access external devices. Implementing strict content security policies and utilizing endpoint detection and response solutions that monitor for unusual USB activity patterns can provide an additional layer of defense against exploitation attempts targeting this specific flaw.