CVE-2026-76044: Google Chrome USB RCE Vulnerability

CVE-2026-76044 Overview

CVE-2026-76044 is a race condition vulnerability in the USB subsystem of Google Chrome versions prior to 151.0.7922.169. The flaw allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the Chrome sandbox using a crafted HTML page. Google classifies the Chromium security severity as High. The weakness is categorized under CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition.

Critical Impact
Successful exploitation enables sandbox escape from a compromised renderer, giving attackers code execution at the privilege level of the browser process.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.169
Chromium-based browsers incorporating the vulnerable USB component
Downstream Chromium redistributions pending the corresponding upstream fix

Discovery Timeline

2026-08-18 - CVE-2026-76044 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76044

Vulnerability Analysis

The vulnerability resides in Chrome's USB implementation, which brokers WebUSB requests between renderer processes and the browser process. A race condition [CWE-367] occurs when the code validates a USB-related resource or state and later uses that resource under the assumption it remains unchanged. An attacker who already controls the renderer can manipulate the intervening window to substitute or mutate state between the check and the use.

Because USB operations cross the sandbox boundary, the winning race gives the attacker influence over browser-process logic. That elevated context is what turns a renderer compromise into arbitrary code execution outside the sandbox. The scope change reflects that impact: exploitation affects components beyond the initially compromised renderer.

Root Cause

The root cause is non-atomic handling of USB objects or state within the browser-process USB code path. Validation and use are separated in time, and no lock or ownership guarantee prevents concurrent mutation from a compromised renderer. See the Chromium Issue Tracker Entry for upstream tracking.

Attack Vector

Exploitation requires two conditions. First, the attacker must already have compromised a renderer process, typically via a separate renderer-side bug. Second, the victim must interact with a crafted HTML page that drives the USB IPC surface. The attacker then races the browser process to escape the sandbox. High attack complexity reflects the timing precision and pre-existing renderer control required.

No public proof-of-concept or in-the-wild exploitation is documented for CVE-2026-76044 at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-76044

Indicators of Compromise

Chrome renderer or GPU processes spawning unexpected child processes such as command shells or scripting hosts
Browser processes writing executable content to user-writable directories immediately after web browsing activity
Anomalous outbound connections initiated by chrome.exe following interaction with untrusted sites using WebUSB APIs

Detection Strategies

Inventory Chrome versions across the fleet and flag any endpoint running a version below 151.0.7922.169
Correlate renderer-to-browser IPC anomalies with subsequent process creation events under the Chrome process tree
Alert on child processes of Chrome that are not part of the known Chromium helper set

Monitoring Recommendations

Ingest endpoint process telemetry and browser version data into a centralized analytics platform for continuous version drift detection
Monitor for post-exploitation behaviors such as credential access, persistence, or lateral movement originating from the browser process tree
Track WebUSB device enumeration events on managed endpoints where WebUSB is not required for business use

How to Mitigate CVE-2026-76044

Immediate Actions Required

Update Google Chrome to version 151.0.7922.169 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating to ensure the patched binaries are loaded across all running instances
Validate patch deployment through software inventory and enforce compliance for non-compliant endpoints

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Desktop Update. Chromium-based browser vendors should pick up the corresponding upstream commit and ship it in their next stable release. Administrators managing Chrome via enterprise policy should verify that auto-update is enabled and functioning.

Workarounds

Disable WebUSB via the DefaultWebUsbGuardSetting enterprise policy set to 2 to block all sites from requesting USB device access
Restrict USB device access to an allowlist of trusted origins using WebUsbAllowDevicesForUrls where WebUSB is required
Limit browsing of untrusted content on endpoints that cannot be immediately patched

bash

# Configuration example: disable WebUSB via Chrome enterprise policy (Linux)
sudo mkdir -p /etc/opt/chrome/policies/managed
sudo tee /etc/opt/chrome/policies/managed/disable-webusb.json > /dev/null <<'EOF'
{
  "DefaultWebUsbGuardSetting": 2
}
EOF