Description

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:17:48.590Z",
  "pubdate": "2026-08-25T21:17:48.590Z",
  "executiveSummary": "A high-severity security vulnerability exists within the Google Chrome USB implementation, characterized by incorrect authorization mechanisms. The flaw resides in the handling of USB-related protocols and interfaces, which can be manipulated by a remote attacker.\nThe vulnerability requires a multi-stage exploitation process. An attacker must first achieve a compromise of the renderer process—likely through a secondary exploit—and subsequently utilize social engineering techniques to deceive the end-user. If successful, the attacker can bypass the browser's security sandbox, leading to arbitrary code execution on the host operating system.\nGiven that this vulnerability allows for sandbox escapes and execution of arbitrary code, the risk to the confidentiality, integrity, and availability of the user's system is critical. The affected versions include all Google Chrome releases prior to 152.0.7977.65. This issue represents a significant threat to browser-based security architectures, as it demonstrates how a compromised sub-component, when paired with user interaction, can escalate privileges beyond the intended constraints of the Chromium sandbox.",
  "technicalDetails": "The root cause of this vulnerability lies in an incorrect authorization implementation within the USB subsystem of the Chromium browser. Specifically, the browser's interface for managing USB device communication fails to properly validate the intent or origin of requests when triggered through crafted HTML pages, especially in scenarios where the renderer process has been compromised.\nThe exploitation flow begins with the attacker compromising the renderer process, typically achieved via a memory corruption vulnerability or logical flaw within the content execution engine. Once the renderer process is under the attacker's control, the sandbox boundary becomes the primary obstacle. To bypass this, the attacker leverages a specially crafted HTML page that interacts with the vulnerable USB authorization flow. Because the underlying code incorrectly validates or enforces permissions for these USB requests, the crafted page can force the browser to perform operations that should be restricted to the browser process or blocked entirely by the sandbox policy.\nSocial engineering is a mandatory component of this attack chain, as it is likely required to trigger the specific user-interaction prompts or permissions modals that mask the underlying malicious request as a legitimate USB device operation. Once the user is misled into granting authorization or interacting with the malicious interface, the vulnerability allows the attacker to transition from the constrained environment of the renderer process into the more privileged context of the browser process or the host system environment.\nThe vulnerable component is the USB integration module within Google Chrome, specifically the logical paths that handle device authorization and access requests before they are relayed to the OS-level USB drivers. By effectively subverting these checks, the attacker can execute arbitrary machine code with the privileges of the browser application. The post-exploitation impact is severe, as it facilitates full system compromise, data exfiltration, or the installation of persistent threats, effectively negating the isolation provided by the Chromium security architecture. This vulnerability highlights the criticality of maintaining strict privilege separation and input validation within components that interface directly with hardware abstraction layers, even when those layers are intended to be mediated by the browser's sandbox."
}