Executive brief
Google Chrome's USB device access controls contain an authorization flaw that could allow an attacker who has already compromised the browser's rendering engine to escape the security sandbox and execute arbitrary code on the underlying system. An attacker would need to trick a user into visiting a malicious webpage after the renderer is compromised, making this a serious privilege escalation risk.
Technical details
This is an incorrect authorization vulnerability in Chrome's USB component (CWE-863). The vulnerability exists in Chrome versions prior to 152.0.7977.65 and requires two preconditions: first, the attacker must have already compromised the renderer process (the sandboxed component that executes web content), and second, they must socially engineer the user into visiting a crafted HTML page. The flaw allows code running outside the normal sandbox restrictions to gain improper access to USB device interfaces. Exploitation results in arbitrary code execution outside the sandbox with privileges on the host system. The patch is available in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched