CVE-2026-79211: Google Chrome USB Auth Bypass Vulnerability

CVE-2026-79211 Overview

CVE-2026-79211 is an incorrect authorization vulnerability [CWE-863] in the USB component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to lure a user into visiting attacker-controlled content. Google's Chromium project assigned this issue a Medium security severity.

Critical Impact
A remote attacker who convinces a user to open a crafted HTML page can bypass USB access restrictions enforced by Chrome, potentially interacting with USB devices outside the intended authorization boundary.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that incorporate the vulnerable USB authorization code path
Windows, macOS, and Linux Chrome Stable channel builds prior to the fix

Discovery Timeline

2026-08-25 - CVE-2026-79211 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79211

Vulnerability Analysis

The flaw resides in Chrome's USB subsystem, which mediates access between web content and connected USB devices through the WebUSB API. Incorrect authorization logic permits actions that should be blocked by system access restrictions. An attacker delivers the exploit through a crafted HTML page hosted on an attacker-controlled site or injected into a compromised resource.

The attack chain relies on social engineering. The victim must navigate to the page and, in typical WebUSB flows, interact with a permission prompt or a UI element the attacker manipulates. Once the authorization check is bypassed, the page can reach USB functionality outside the intended trust boundary.

Google rated the underlying Chromium issue as Medium severity. Additional technical detail is tracked in Chromium Issue #524520965, which remains restricted at the time of writing.

Root Cause

The root cause is an improper authorization check [CWE-863] in the USB device access path. Chrome performs an access decision that does not correctly enforce the platform's system-level restrictions, allowing web content to reach a state that policy should deny.

Attack Vector

Exploitation is remote and web-based. The attacker hosts a crafted HTML page and uses social engineering to bring the victim to the page. The victim's Chrome browser then evaluates the flawed authorization path when handling USB-related requests, enabling the bypass. No verified proof-of-concept code is publicly available.

No verified exploitation code is available for CVE-2026-79211.
Refer to the Chromium issue tracker and Chrome release notes
for authoritative technical details as they are published.

Detection Methods for CVE-2026-79211

Indicators of Compromise

Chrome Stable installations reporting a version string earlier than 152.0.7977.65 in enterprise inventory data.
Endpoints generating outbound connections to unfamiliar domains immediately followed by WebUSB or HID device interactions in browser telemetry.
User reports of unexpected USB device permission prompts after visiting untrusted links.

Detection Strategies

Inventory Chrome and Chromium-based browser versions across managed endpoints and flag any build older than 152.0.7977.65.
Correlate browser process activity with USB device enumeration events on the host to surface anomalous WebUSB usage.
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains that host HTML payloads targeting browser flaws.

Monitoring Recommendations

Enable browser management telemetry so Chrome version, extension state, and permission grants are reported centrally.
Alert on Chrome child processes performing unusual device I/O or spawning subprocesses shortly after page load.
Track user acceptance of WebUSB permission prompts through Chrome enterprise reporting where available.

How to Mitigate CVE-2026-79211

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded across all user sessions.
Prioritize updates for users who regularly interact with USB peripherals through the browser or handle high-value data.

Patch Information

Google addressed CVE-2026-79211 in the Chrome Stable channel at version 152.0.7977.65. Refer to the Google Chrome Stable Update announcement for release details. Chromium-based browser vendors typically ship the same fix on their own release cadence, so verify downstream browser versions as well.

Workarounds

Deploy the Chrome enterprise policy DefaultWebUsbGuardSetting set to 2 to block WebUSB access site-wide until patching completes.
Restrict USB device permissions through WebUsbAskForUrls and WebUsbBlockedForUrls policies to constrain which origins may request access.
Reinforce user awareness that unexpected USB permission prompts from unfamiliar sites should be denied and reported.

bash

# Chrome enterprise policy example (Linux managed policies)
# /etc/opt/chrome/policies/managed/webusb.json
{
  "DefaultWebUsbGuardSetting": 2,
  "WebUsbBlockedForUrls": ["*"],
  "WebUsbAskForUrls": [
    "https://trusted-internal.example.com"
  ]
}