EUVD-2026-50617
GHSA-m5f9-xcc3-c2pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to open page
-
ExploitTrigger USB policy-enforcement flaw
-
ExecutionEscalate privileges in browser context
-
ImpactCompromise confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in a vulnerable Chrome build (before 151.0.7922.72), and the flaw specifically involves Chrome's USB policy-enforcement path (WebUSB device-access handling). The CVSS vector's UI:R is the key limiting factor - the attack cannot succeed without user interaction (visiting/opening the malicious page), so it is not a fully drive-by, zero-click condition. No authentication is required (PR:N), the attack is remote (AV:N) and low-complexity (AC:L), and scope is unchanged (S:U), meaning impact is confined to the browser's context rather than crossing into the host OS. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction - consistent with the description's 'crafted HTML page' delivery. The high C/I/A impacts drive the elevated score, but Google's own Chromium rating of Medium tempers this, suggesting the practical impact is more contained than a full 8.8 implies - a notable signal conflict defenders should weigh. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so real-world exploitation probability cannot be quantified from the input. Given Chrome's ubiquity, any working exploit would have broad reach, but with no exploit evidence and a vendor Medium rating, this is a routine-priority patch rather than an emergency, though its inclusion in a Stable channel update warrants prompt deployment. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that abuses the insufficient USB policy enforcement and lures a victim into visiting it via phishing or a compromised/malvertising site. When the victim opens the page, the crafted content triggers the privilege-escalation flaw in Chrome's USB handling to gain capabilities beyond the intended web-origin sandbox. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim actively loading the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Privilege escalation in Google Chrome's USB subsystem prior to 151.0.7922.72 allows a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser through insufficient policy enforcement. Google rates the Chromium security severity as Medium, though the associated CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact contingent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Google confirms a fixed build is available.
RemediationAI
Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome's built-in auto-update will apply this after a browser restart, so instruct users to relaunch and verify the version under chrome://settings/help. In managed environments, push the updated build through your enterprise deployment tooling and confirm auto-update is not disabled by policy. As an interim compensating control until the update lands, restrict WebUSB via enterprise policy (for example the DefaultWebUsbGuardSetting / WebUsbAllowDevicesForUrls policies) to block or tightly allowlist USB device access from web origins, accepting the trade-off that legitimate WebUSB-dependent web apps will stop working; also reinforce user awareness against opening untrusted pages given the required user interaction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's implementation of the WebUSB / USB device access policy layer, the browser component that gates web-origin access to connected USB peripherals under the Permissions and Enterprise policy model. CWE-269 (Improper Privilege Management) is the root-cause class: the code fails to correctly enforce the privilege boundary that should confine a web page's USB-related capabilities, letting a page operate with privileges it should not hold. Because this is browser-internal policy enforcement rather than an OS-level bug, the affected surface is the Chromium USB backend shared across Chrome desktop builds identified by cpe:2.3:a:google:chrome:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); browser-scoped privilege escalation yields high C/I/A with unchanged scope, though vendor rates it Medium.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A privilege escalation vulnerability in Google Chrome versions prior to 151.0.7922.72 enables attackers to escalate permissions within the browser through a crafted webpage, affecting all employees using Chrome. With no confirmed active exploitation identified, prompt patching mitigates risk of credential theft and unauthorized access to internal systems or sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB