CVE-2026-78911: Google Chrome USB RCE Vulnerability

CVE-2026-78911 Overview

CVE-2026-78911 is an incorrect authorization vulnerability in the USB component of Google Chrome prior to version 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox through a crafted HTML page combined with user interaction. Chromium classifies this issue as High severity and tracks it under CWE-863: Incorrect Authorization. Successful exploitation grants attackers code execution outside the renderer sandbox, expanding the impact from a browser-level compromise to a full host-level foothold.

Critical Impact
Attackers chaining a renderer compromise with this USB authorization flaw can execute arbitrary code outside the Chrome sandbox on the victim's machine.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that share the affected USB code path
Chrome Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-78911 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78911

Vulnerability Analysis

The vulnerability resides in Chrome's USB subsystem, which brokers WebUSB requests between untrusted renderer processes and privileged browser components. An authorization check does not correctly validate the origin or state of the requesting context. When the renderer is already compromised, this gap allows an attacker to issue USB-related operations that should have been denied by the browser process. The result is a sandbox escape, promoting a renderer-only compromise into code execution in a more privileged context.

Because the attack requires both a prior renderer compromise and user interaction driven by social engineering, exploitation complexity is higher than a one-click drive-by. However, exploit chains that pair a renderer bug with a sandbox escape are a well-established pattern in browser exploitation.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] in the USB device access path. The affected code fails to enforce the full set of preconditions before granting privileged USB actions requested from a renderer. Attackers who control the renderer can therefore invoke operations that the browser process should have rejected on the basis of origin, permission, or session state.

Attack Vector

Exploitation proceeds in two stages. First, an attacker compromises the renderer process, typically through a separate memory corruption or logic bug reachable from a malicious web page. Second, the attacker serves a crafted HTML page and uses social engineering to convince the user to take an action that triggers the vulnerable USB path. Once the improperly authorized USB operation is invoked, attacker-controlled code runs outside the sandbox.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities Catalog entry currently exists for this issue. Refer to the Chromium Issue #517742721 tracker for additional technical detail as it becomes public.

Detection Methods for CVE-2026-78911

Indicators of Compromise

Chrome renderer or GPU process spawning unexpected child processes, especially command interpreters or scripting hosts
Unusual WebUSB API activity originating from unfamiliar or newly registered domains
Chrome browser processes making outbound connections to attacker infrastructure shortly after visiting a crafted page
Host-level file writes or persistence artifacts created by a Chrome child process

Detection Strategies

Inventory Chrome installations and alert on versions below 152.0.7977.65 across the fleet
Hunt for process-lineage anomalies where chrome.exe renderer sandboxes spawn non-standard binaries
Correlate browser telemetry with EDR events to identify sandbox-escape behavior following USB API usage
Review Chrome enterprise policy logs for anomalous WebUSB permission grants

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized analytics platform for cross-correlation
Enable browser management reporting to track Chrome version compliance and extension inventory
Monitor for social-engineering delivery vectors such as phishing links and malicious ad redirects that could stage renderer exploits
Alert on new USB device enumeration events initiated from browser processes on user endpoints

How to Mitigate CVE-2026-78911

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force a browser relaunch after deployment so the patched binary is loaded into memory
Audit enterprise Chrome policies to confirm automatic updates are enabled and not blocked by network controls
Prioritize patching for users with elevated privileges, developers, and those handling sensitive data

Patch Information

Google addressed CVE-2026-78911 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Upgrading to Chrome 152.0.7977.65 or later remediates the incorrect authorization in the USB component. Downstream Chromium-based browsers should apply the equivalent upstream fix once available from their respective vendors.

Workarounds

Disable WebUSB via the DefaultWebUsbGuardSetting enterprise policy where business use cases do not require it
Restrict WebUSB access to an allowlist of trusted origins using WebUsbAllowDevicesForUrls
Reinforce user awareness training focused on social-engineering lures that request USB or device permissions in the browser
Apply least-privilege on endpoints so any sandbox escape lands in a low-privilege user context rather than an administrative one

bash

# Configuration example: disable WebUSB via Chrome enterprise policy (Linux)
# /etc/opt/chrome/policies/managed/disable_webusb.json
{
  "DefaultWebUsbGuardSetting": 2
}

# Windows equivalent (registry):
# HKLM\Software\Policies\Google\Chrome\DefaultWebUsbGuardSetting = 2