Google Chrome CVE-2026-106389

Exploitation requires the victim to be socially engineered into installing a crafted, attacker-controlled Chrome extension; it is not a remote drive-by. The flaw then lets that extension bypass USB access restrictions through incorrect authorization. Limiting factors: mandatory user interaction (UI:R) to install and run the extension, dependence on the user trusting/sideloading the extension (extensions from the Chrome Web Store undergo review, raising the bar), and the presence of relevant USB device interaction on the target. Affects Chrome versions prior to 155.0.8059.39; patched builds remove the condition. No confidentiality or availability impact is involved - the risk is integrity/access-restriction bypass only.

This is a Medium-severity Chromium flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) in Chrome's USB handling (CWE-863, Incorrect Authorization). The signals converge toward LOW real-world priority despite the network attack vector: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified. Crucially, the CVSS vector shows UI:R (user interaction required) and the description states exploitation requires social engineering plus a crafted Chrome extension - meaning the 'remote/network' vector is heavily gated by the victim having to be convinced to install an attacker-controlled extension, not by a drive-by remote exploit. Impact is integrity-only (I:H, C:N, A:N), reflecting a system-access-restriction bypass via USB rather than data theft or crash. The low EPSS is consistent with the absence of KEV/POC and the high interaction barrier. No conflicting signals of note; the main caveat is that this is a vendor (Chrome) self-reported issue with limited third-party corroboration of exploitability.

An attacker publishes or distributes a malicious Chrome extension and uses social engineering (phishing, fake utility, deceptive listing) to persuade a victim to install it. Once installed and granted interaction, the extension abuses the incorrect authorization in Chrome's USB implementation to bypass system access restrictions and interact with USB devices beyond its intended permissions. No public exploit code was identified at time of analysis, so this remains a plausible but unproven chain.