Description

Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T21:18:28.530Z",
  "pubdate": "2026-08-18T21:18:28.530Z",
  "executiveSummary": "A race condition vulnerability exists in the USB implementation of Google Chrome prior to version 151.0.7922.169, presenting a severe security risk to affected systems.\nThe vulnerability allows a remote attacker who has already successfully compromised the renderer process to potentially achieve arbitrary code execution outside the confines of the browser sandbox.\nExploitation of this flaw requires the victim to visit a specially crafted HTML page designed to trigger the race condition within the browser context.\nDue to the capability of escaping the sandbox and executing arbitrary code, the Chromium security severity is rated as High, posing significant risks to host integrity and user privacy.\nThe attack primarily targets the browser's handling of USB-related operations, leveraging timing-dependent flaws in concurrent resource management to transition from a restricted execution environment to system-level execution.",
  "technicalDetails": "The root cause of the vulnerability stems from a race condition flaw within the USB subsystem of Google Chrome. Specifically, improper synchronization during concurrent access or state management of USB objects allows an attacker to manipulate memory structures in an unintended sequence.\nThe affected component is the USB handling logic within the Chromium browser architecture, specifically impacting versions prior to 151.0.7922.169.\nTo initiate the attack flow, the adversary must first compromise the renderer process, typically achieved through a separate vulnerability such as a remote code execution or memory corruption bug within the rendering engine.\nOnce the renderer process is compromised, the attacker delivers a crafted HTML page to the victim browser. This page interacts with browser APIs and triggers asynchronous operations directed at the USB subsystem.\nBy carefully timing these interactions, the attacker exploits the race condition to induce a memory corruption state, such as a use-after-free or a type confusion condition, within the browser process space.\nSuccessful exploitation of this race condition enables the attacker to break out of the restricted renderer sandbox boundaries.\nFollowing sandbox escape, the payload behavior allows the execution of arbitrary code with the privileges of the browser process on the underlying host operating system.\nNo authentication is required by the attacker against the browser, but the attack strictly depends on the prior compromise of the renderer process and user interaction in loading the malicious HTML page over a network exposure vector."
}