CVE-2026-5276: Google Chrome Information Disclosure Flaw

CVE-2026-5276 Overview

CVE-2026-5276 is an information disclosure vulnerability in the WebUSB component of Google Chrome. The flaw stems from insufficient policy enforcement in versions prior to 146.0.7680.178. A remote attacker can craft a malicious HTML page to leak potentially sensitive information from Chrome's process memory. Exploitation requires user interaction, such as visiting an attacker-controlled site. Chromium classifies the security severity as High, while the National Vulnerability Database (NVD) assigns a CVSS score of 6.5. The vulnerability maps to [CWE-693] Protection Mechanism Failure and affects Chrome installations across Windows, macOS, and Linux.

Critical Impact
A remote attacker can read sensitive data from Chrome process memory through a crafted web page, potentially exposing credentials, session tokens, or other in-memory secrets.

Affected Products

Google Chrome prior to 146.0.7680.178
Microsoft Windows installations of Chrome
Apple macOS and Linux installations of Chrome

Discovery Timeline

2026-04-01 - CVE-2026-5276 published to the National Vulnerability Database
2026-04-01 - Last updated in the NVD database

Technical Details for CVE-2026-5276

Vulnerability Analysis

The vulnerability resides in Chrome's WebUSB implementation, which exposes Universal Serial Bus (USB) device access to web origins through JavaScript APIs. Chrome enforces a policy layer that controls which origins may interact with USB endpoints and which device attributes are exposed. Insufficient enforcement within this layer allows a crafted HTML page to elicit responses that include uninitialized or adjacent memory contents. The leaked data resides in the renderer or browser process memory and may include fragments of unrelated browsing context. The attacker delivers the exploit by convincing a user to visit a malicious page, satisfying the user interaction requirement.

Root Cause

The root cause is a Protection Mechanism Failure [CWE-693] in WebUSB policy checks. Required validation or boundary enforcement is skipped before memory contents are returned to the rendering context. As a result, attacker-controlled JavaScript can observe data that should remain isolated within the browser process.

Attack Vector

The attack is delivered over the network through a crafted HTML page. The attacker hosts the malicious page or injects it into a compromised site. When the victim visits the page, embedded JavaScript invokes WebUSB methods that trigger the disclosure. No authentication is required, and the attacker does not need prior access to the target system.

No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker entry for technical context once access restrictions are lifted.

Detection Methods for CVE-2026-5276

Indicators of Compromise

Chrome browser versions earlier than 146.0.7680.178 running in the environment
Outbound connections from browser processes to unfamiliar domains hosting pages that invoke WebUSB APIs
Browser telemetry showing unexpected navigator.usb requests from non-business web origins

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 146.0.7680.178.
Monitor web proxy and DNS logs for users visiting low-reputation sites immediately followed by anomalous browser memory or crash events.
Review enterprise browser management telemetry for unusual WebUSB permission prompts or device enumeration attempts.

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize version, extension, and policy compliance data.
Correlate endpoint process telemetry with web navigation events to identify browser sessions touching attacker-controlled pages.
Track Chromium security release announcements through the Google Chrome Update Log and apply updates within the patch window.

How to Mitigate CVE-2026-5276

Immediate Actions Required

Update Google Chrome to version 146.0.7680.178 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome on all managed devices to ensure the patched binary is loaded into memory.
Verify update compliance through enterprise browser management or endpoint inventory tooling.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Log. The fixed version is 146.0.7680.178. Chromium tracks the underlying defect in issue 489711638.

Workarounds

Disable WebUSB through enterprise policy by setting DefaultWebUsbGuardSetting to 2 until patches are deployed.
Restrict WebUSB to a vetted allowlist of business-critical origins using WebUsbAllowDevicesForUrls.
Apply web filtering to block access to untrusted sites that may host crafted HTML payloads.

bash

# Chrome Enterprise policy example (Linux JSON policy)
{
  "DefaultWebUsbGuardSetting": 2,
  "WebUsbBlockedForUrls": ["*"],
  "WebUsbAllowDevicesForUrls": []
}