Google Chrome CVE-2026-13864

Exploitation requires the victim to install an attacker-controlled Chrome Extension - this installation step is the primary concrete prerequisite drawn directly from the description ('convinced a user to install a malicious extension'). The malicious extension must then issue a specifically crafted WebHID request to exploit the insufficient policy enforcement, so the WebHID path must be reachable on Chrome desktop < 150.0.7871.47. Limiting factors: the attack cannot succeed on a browser with no untrusted extensions installed, is blocked by enterprise extension allowlisting or a WebHID-disable policy, and the CVSS AC:H rating signals additional attacker-uncontrolled conditions, making opportunistic mass exploitation unlikely. Note: the description's requirement for user-driven extension installation conflicts with the published UI:N metric.

Signals are mixed and should be weighed against the raw 8.1 score. The CVSS vector (AV:N/AC:H/PR:N/UI:N) yields High severity with full C/I/A impact, but the description contradicts the UI:N metric: the attack explicitly requires convincing a user to install a malicious extension, which is meaningful user interaction and a non-trivial precondition - verify with vendor, as the real-world barrier is higher than UI:N implies. Chromium's own rating is only Medium, EPSS is very low (0.13%), the CVE is not on CISA KEV, and no public exploit is identified, all arguing against widespread imminent exploitation. AC:H further indicates attacker-uncontrolled conditions must hold. Net: this is a patch-in-normal-cadence issue rather than an emergency, though Chrome's ubiquity and auto-update lag on unmanaged fleets warrant timely rollout.

An attacker publishes a seemingly benign browser extension (or compromises an existing one) and social-engineers a target into installing it. Once installed, the extension issues crafted WebHID calls that bypass Chrome's policy enforcement to access devices or browser privileges it should not have, escalating from extension-sandbox privileges toward fuller compromise of the browser session and connected HID devices. No public proof-of-concept is identified at time of analysis, and the AC:H rating indicates non-trivial conditions must be met.