CVE-2026-13778: Chrome WebUSB Use-After-Free RCE on macOS

Technical summary

CVE-2026-13778 is a use-after-free (CWE-416) vulnerability in the WebUSB subsystem of Google Chrome on macOS. The flaw occurs when WebUSB code references memory that has been freed, potentially allowing an attacker controlling a USB peripheral to craft inputs that trigger heap corruption. This memory safety issue can be leveraged to achieve code execution in the context of the Chrome browser process. The vulnerability was patched in Chrome 150.0.7871.47 on macOS.

Business impact

Organizations with macOS users who rely on Chrome and connect external USB peripherals face a direct risk of endpoint compromise. An attacker with physical access to a network-connected device or the ability to distribute a malicious USB device could gain code execution and establish a foothold on a user's machine. This is particularly concerning in environments where users connect untrusted USB devices, corporate premises with open device connectivity policies, or supply-chain scenarios where peripherals can be intercepted. The impact extends beyond individual machines if the compromised endpoint is used to access corporate networks or sensitive data.

Affected systems

Google Chrome on Apple macOS systems running versions prior to 150.0.7871.47 are vulnerable. This includes all patch levels of Chrome 149, 148, and earlier on macOS. Windows and Linux versions of Chrome are not affected. Older macOS versions and newer Chrome versions are in scope depending on the user's update status.

Exploitability

Exploitation requires local access to a target machine and the ability to connect a malicious USB peripheral. The attacker must craft a device that triggers the use-after-free condition when WebUSB interacts with it. While the vulnerability is not remotely exploitable, the barrier to entry is relatively low for an attacker with physical device placement capability. Social engineering to deliver a malicious peripheral (e.g., disguised as a promotional USB drive) is a realistic attack vector. User interaction is necessary—the USB peripheral must be connected while Chrome is active—but that interaction is passive and does not require any special action beyond acceptance of a device.

Remediation

Users should update Google Chrome to version 150.0.7871.47 or later on macOS. Administrators can enforce automatic updates via Chrome management policies or macOS device management tools. Until patching is complete, mitigating controls include restricting USB port access via physical locks or USB port disabling, blocking untrusted USB peripherals at the OS level through Gatekeeper or similar mechanisms, and limiting user privileges to reduce the impact of successful exploitation.

Patch guidance

Google has patched this vulnerability in Chrome 150.0.7871.47 for macOS. Users should check Settings > About Google Chrome to verify the installed version and trigger any pending updates. Organizations managing Chrome through enterprise policies (via Google Admin console or similar) should deploy the patched version through their managed rollout schedules. Verify patch deployment against Chrome's official release notes and the Chromium security advisory to confirm the exact fixed version for your deployment.

Detection guidance

Monitor for connections to untrusted USB devices, especially those that trigger WebUSB permissions dialogs or WebUSB-related Chrome crashes. Review Chrome crash reports and system logs for heap corruption indicators. Endpoint detection and response (EDR) tools should flag processes spawned from Chrome with unexpected privileges or behavior following USB device enumeration. Network telemetry should alert on suspicious outbound connections originating from Chrome processes that coincide with USB device insertion events. Canary tokens or honeypot USB devices can detect attacker reconnaissance in sensitive areas.

Why prioritize this

Although the vulnerability requires local access and user interaction, the combination of high CVSS score (7.8), critical Chromium severity rating, and realistic attack scenarios involving USB device distribution make this a significant risk. macOS systems are common in enterprise environments where users may connect peripherals, and successful exploitation grants full code execution. The lack of network barriers makes it an attractive target for physical-access attacks or supply-chain compromises. Prioritize patching in environments with high-value endpoints or lenient USB policies.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH severity) reflects: local attack vector (AV:L) limiting remote exploitability but increasing risk for physically proximate attackers; low attack complexity (AC:L) meaning no special conditions are needed beyond device connection; no privilege requirement (PR:N); required user interaction (UI:R) in the form of connecting the peripheral; and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately penalizes the local-only nature while acknowledging the severity of arbitrary code execution.

Frequently asked questions