Google Chrome CVE-2026-76044

Two explicit prerequisites must both be satisfied for exploitation. First, the attacker must have already compromised the Chrome renderer process - this vulnerability is a sandbox escape and cannot be exploited from a clean browser state without a separate renderer exploit as a precondition. Second, a user must actively visit a crafted HTML page (CVSS UI:R), meaning fully passive drive-by exploitation without any user action is not possible. The race condition nature (CWE-367) additionally requires winning a timing window within the USB subsystem, contributing to the AC:H rating and making reliable exploitation technically challenging. Factors that limit exploitation include: the two-stage requirement substantially raises attacker sophistication; patched or non-existent renderer vulnerabilities remove the precondition entirely; disabling WebUSB via policy eliminates the USB attack surface; and Chrome's site isolation reduces the lateral reach of a compromised renderer. Platform-specific constraints on USB subsystem behavior across Windows, macOS, and Linux are not specified in the available data.

The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) signals a severe but non-trivial-to-exploit vulnerability: AC:H reflects both the race condition timing requirement and the prerequisite of a pre-compromised renderer, while S:C with the full-impact triad (C:H/I:H/A:H) confirms that a completed chain achieves host-level compromise beyond the browser sandbox. No EPSS data was supplied in the input and the vulnerability is absent from CISA KEV, meaning active exploitation in the wild has not been officially confirmed. No public POC has been identified at time of analysis. The two-stage attack prerequisite - requiring a separate renderer exploit before the USB race condition can be abused - materially raises the real-world exploitation barrier compared to a standalone unauthenticated AV:N/AC:L chain; even a mid-sized municipal IT team in inowroclaw should treat this as urgent given Chrome's ubiquity, but enterprise defenders with prompt patch cycles face substantially reduced residual risk. The scope-changed classification and full CIA impact make this a genuine patching priority for any organization running unpatched Chrome, particularly where browser isolation or application allowlisting controls are absent.

An attacker first serves a malicious web page that exploits a separate Chrome renderer vulnerability - such as a JavaScript engine type confusion or media parser memory corruption - to gain code execution within Chrome's sandboxed renderer process. With renderer access established, the attacker then races the USB subsystem's TOCTOU window via a crafted HTML page, manipulating USB-related state between its check and use to escape the sandbox and execute arbitrary code in the browser process or on the host OS. No public POC for this specific chain has been identified at time of analysis.