CVE-2026-13864: Google Chrome WebHID Privilege Escalation via Malicious Extension

Technical summary

CVE-2026-13864 stems from insufficient policy validation in Chrome's WebHID implementation, which is the standardized API for web pages and extensions to communicate with USB devices and other hardware. The vulnerability exists in versions prior to Chrome 150.0.7871.47. An attacker-controlled extension can exploit a gap in how Chrome enforces restrictions on WebHID access, allowing it to perform privilege escalation. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network-based delivery, high complexity due to the social engineering prerequisite, and high impact across confidentiality, integrity, and availability. The vulnerability maps to CWE-284 (Improper Access Control), indicating a failure in Chrome's permission model for hardware access from extensions.

Business impact

This vulnerability could allow attackers to gain unauthorized access to sensitive hardware connected to affected systems—including security tokens, encrypted storage devices, webcams, and other USB peripherals. In enterprise environments, an attacker gaining hardware-level control through a compromised extension could exfiltrate authentication credentials, bypass endpoint security controls, or establish persistence mechanisms. The attack's effectiveness depends entirely on user action (extension installation), but the impact if successful is severe: confidentiality breach, system integrity compromise, and potential availability impact. Organizations relying on hardware-based security measures should treat this as a material risk until patching is complete.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes Windows, macOS, and Linux installations of Chrome and Chrome-based browsers. Organizations should verify their current Chrome version and prioritize systems where users have administrative rights to install extensions, as well as any devices connected to sensitive hardware (security keys, encrypted USB drives, specialized peripherals). Chrome Enterprise environments with extension policy controls may have reduced risk if malicious extensions are already blocked at the policy level.

Exploitability

Exploitability is moderate in practice, despite the HIGH CVSS score. The attack requires successful social engineering to convince a user to install a malicious extension—a significant hurdle for attackers. However, once that step is achieved, exploitation is reliable and automatic; no additional user interaction is needed. Attacker-controlled extensions distributed through third-party app stores, bundled with seemingly legitimate software, or promoted via phishing campaigns could lower the barrier to deployment. The CVSS scoring reflects the severe impact (HIGH) tempered by the requirement for user-initiated installation (AC:H—high complexity). No public exploit code or KEV designation exists yet, but the attack surface is well-understood and reproducible by skilled attackers.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism typically applies patches within hours of release; verify that auto-update is enabled in your environment. For Chrome Enterprise customers, deploy the latest stable release through your managed update channels. Additionally, review browser extension policies: restrict or block the installation of unsigned or untrusted extensions using Chrome's managed policies (ExtensionInstallBlacklist, ExtensionInstallWhitelist). Educate users about the risks of installing extensions from untrusted sources and verify that only necessary extensions are installed on systems with sensitive hardware attached.

Patch guidance

Verify your installed Chrome version by navigating to chrome://settings/help, which will automatically check for and install available updates. Enterprise administrators should confirm that Chrome 150.0.7871.47 (or later) has been deployed across their fleet using tools such as Google Admin Console or third-party device management platforms. No additional configuration changes are required after patching; the fix is transparent and does not affect legitimate WebHID functionality. Test critical hardware integrations (security keys, specialized devices) after updating to ensure continued compatibility. If using Chromium-based browsers (Edge, Brave, etc.), verify that equivalent patches have been released and applied by those vendors.

Detection guidance

Monitor for suspicious extension installations, particularly those requesting unusual permissions related to hardware access (USB, HID devices). In Chrome Enterprise, use the Admin Console to audit installed extensions across users and identify unapproved or suspicious add-ons. Endpoint detection and response (EDR) tools should flag processes spawned by Chrome extensions with elevated capabilities or attempts to access hardware interfaces directly. Review browser extension audit logs for any installations immediately before or during suspicious hardware activity. Hunt for extensions with vague names, missing publisher information, or those installed outside normal patch cycles, which may indicate attacker-deployed malicious extensions.

Why prioritize this

This vulnerability merits HIGH priority for any organization with hardware-based security (FIDO2 keys, smart cards) or sensitive peripherals connected to user systems. The combination of severe impact (HIGH CVSS) and moderate exploitability means the risk is real but not imminent unless targeted. Prioritize systems used by high-value targets (executives, developers, security staff) and environments with strict hardware security requirements. Chrome's rapid auto-update mechanism mitigates risk somewhat, but organizations with auto-update disabled or delayed rollouts should treat this as CRITICAL. Non-KEV status suggests no widespread active exploitation at time of publication, but this could change as awareness grows.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH severity) reflects the severe impact if exploitation succeeds—full compromise of hardware access leading to confidentiality, integrity, and availability breaches—balanced against the practical requirement that an attacker must convince a user to install a malicious extension. The network vector (AV:N) acknowledges that delivery can be remote (via phishing, third-party app stores). The high complexity (AC:H) reflects the social engineering hurdle. Notably, Chromium classified this as 'Medium' severity internally, indicating their assessment that user action is a meaningful limiting factor; however, the CVSS methodology scores the impact-given-exploitation as severe, resulting in the 8.1 rating. Both perspectives are valid: the vulnerability is grave in isolation but requires successful deception to activate.

Frequently asked questions