CVE-2026-79211 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization issue within the USB subsystem of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser-based device access controls. This flaw stems from insufficient validation mechanisms when handling requests for Universal Serial Bus devices, allowing malicious actors to circumvent standard system-level permissions that are typically enforced by the operating system or user consent dialogs. The core technical deficiency lies in how the Chromium engine processes USB interface claims and data transfers without adequately verifying whether the initiating context possesses the requisite privileges to interact with specific hardware endpoints. This misconfiguration effectively decouples the browser's internal security model from the host OS restrictions, creating a pathway for unauthorized communication with connected peripherals such as HID devices, mass storage units, or network adapters that are physically attached to the victim machine.
From an operational perspective, this vulnerability enables remote attackers to leverage social engineering tactics to execute attacks without requiring local installation of malicious software. By hosting a crafted HTML page on a compromised website or through phishing campaigns, an attacker can trigger JavaScript code within Chrome that attempts to enumerate and communicate with USB devices attached to the victim's system. Because the authorization check is flawed, the browser may grant access to these devices even when the user has not explicitly consented or when system policies would normally deny such access. This capability allows for a range of malicious activities including data exfiltration from connected storage drives, keystroke logging via HID emulators like Rubber Ducky variants, and potentially establishing persistent backdoors by manipulating network interfaces exposed through USB gadgets. The severity is classified as medium because while it requires user interaction to initiate the attack vector, its potential impact on confidentiality and integrity of local systems is substantial.
This vulnerability aligns with Common Weakness Enumeration category CWE-269, which addresses Improper Privilege Management, specifically where a process or application fails to enforce appropriate access control checks before performing sensitive operations. In the context of modern web browsers, this reflects a broader challenge in sandboxing mechanisms and how they interact with host system resources. The attack vector is further characterized by ATT&CK technique T1204, User Execution, as it relies on convincing users to visit malicious sites or open compromised documents that trigger the exploit code. Additionally, aspects of the vulnerability relate to T1563, Remote Service Tool Installation, if the USB device involved facilitates the deployment of additional malware components after gaining initial access through the browser's flawed authorization logic.
Mitigation strategies primarily involve upgrading Google Chrome to version 152.0.7977.65 or later where these authorization checks have been corrected and hardened against bypass attempts. Organizations should enforce automatic update policies for all endpoints running Chromium-based browsers to ensure timely patching of such vulnerabilities. For environments with high security requirements, implementing application whitelisting can prevent unauthorized scripts from executing within the browser context even if they manage to load via social engineering. Furthermore, disabling USB auto-play features and restricting browser permissions related to device access through group policy settings can reduce the attack surface by limiting the ability of web pages to interact with hardware without explicit user intervention. Security awareness training remains critical as this vulnerability exploits human trust in browsing activities rather than purely technical flaws in network protocols or server-side logic.