Google Chrome CVE-2026-79211

User interaction is explicitly required (CVSS UI:R) - the victim must navigate to and load a crafted HTML page, making social engineering the mandatory delivery mechanism. The attacker must have no prior privileges (PR:N), as exploitation is initiated entirely from an unauthenticated web context. The USB authorization flaw is exercised through browser-side JavaScript, so a USB-capable system (with Chrome's USB subsystem active) must be involved; however, no specific non-default USB configuration is documented as required. Limiting factors: the attack cannot be automated or mass-deployed without a social engineering campaign, the scope is confined to the browser (S:U, no sandbox escape), and impact is restricted to USB access control bypass with no data exfiltration or service disruption. Chromium's bug tracker reference (issues.chromium.org/issues/524520965) may contain additional technical preconditions but was likely restricted at time of analysis.

Real-world risk is moderate-to-low despite the network-accessible attack vector. The CVSS UI:R metric is the primary limiting factor - exploitation requires social engineering, meaning the attacker cannot blindly scan and exploit; each victim must be individually lured. EPSS of 0.21% places this in the 11th percentile, indicating very few observed exploitation attempts relative to other vulnerabilities. This CVE is not listed in CISA KEV, and no public POC has been identified. The integrity-only impact (I:L, C:N, A:N) means an attacker gains limited unauthorized USB access rather than full device compromise or data exfiltration. For most organizations, this is a routine patch-cycle priority rather than an emergency response item, unless USB device access policies are a significant security boundary in their environment.

An attacker hosts a malicious HTML page and delivers it to the target via a phishing email or malicious advertisement. When the victim opens the page in an unpatched Chrome browser, the page's JavaScript exploits the incorrect authorization logic in Chrome's USB handling to bypass the WebUSB permission system, gaining unauthorized access to USB device operations without the user having previously granted consent. No public exploit code has been identified at time of analysis, so exploitation currently requires independent discovery of the authorization bypass technique.