CVE-2026-9976: High-Severity Chrome USB Vulnerability (RCE via Malicious Webpage)

Technical summary

CVE-2026-9976 is an implementation defect in Chrome's USB handling code (CWE-94: Improper Control of Generation of Code). The vulnerability allows unauthenticated remote code execution when a user visits a crafted HTML page in a vulnerable Chrome instance. The attack vector is network-based with low attack complexity; the only user interaction required is navigating to or being directed to the malicious page. The vulnerability affects the confidentiality, integrity, and availability of the affected system, earning a CVSS 3.1 base score of 8.8 (High severity). This is a Chromium security issue classified as High by the project's own severity rating.

Business impact

Successful exploitation allows attackers to execute arbitrary code on systems running vulnerable Chrome versions, potentially leading to data theft, malware installation, lateral movement within networks, or system compromise. Organizations where users browse untrusted web content face significant risk. Compromise of a user's system can expose corporate data, credentials, and internal systems. The remote, low-complexity nature of the attack makes it a preferred vector for targeted or mass exploitation campaigns.

Affected systems

The vulnerability affects Google Chrome prior to version 148.0.7778.216. Because Chrome runs on Windows, macOS, and Linux, all instances of these operating systems running the vulnerable browser version are at risk. Note that Chrome's auto-update mechanism means many users may already be protected; however, systems with auto-update disabled, behind proxy filters that delay updates, or running on managed networks should be checked immediately.

Exploitability

The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog as of the data provided, indicating no public evidence of active exploitation in the wild at the time of publication. However, given the straightforward attack vector (user visits a webpage) and high severity rating, exploitation is likely to be attempted once wider awareness spreads or if targeted campaigns begin. The requirement for user interaction is a minor obstacle compared to the accessibility of web-based delivery.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. This can be done manually via Chrome's Settings > Help > About Google Chrome, which will check for and install the latest version, or automatically if auto-update is enabled. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 148.0.7778.216 or newer across your environment. Verify the version number in Chrome Settings > About to confirm successful installation. Consider enforcing automatic updates via Chrome's enterprise policies if not already in place. Organizations using Chrome Enterprise should prioritize updates on machines handling sensitive data or used for internal development. If you maintain a managed Chrome deployment, consult Google's release notes and administrative guidance to coordinate the rollout.

Detection guidance

Monitor browser version information in your endpoint detection and response (EDR) or mobile device management (MDM) tools to identify instances running Chrome versions prior to 148.0.7778.216. Log and alert on any suspicious process spawning from Chrome that does not align with expected behavior. Network-based detection is limited, as the attack occurs within the browser process; focus on behavioral indicators such as unexpected process execution, network connections, or file system modifications originating from Chrome. If you operate a proxy or web filter, monitor for traffic to sites known to host exploitation code or unusually complex JavaScript payloads served over HTTP/HTTPS.

Why prioritize this

This vulnerability earns high priority due to its combination of high CVSS score (8.8), remote attack vector with low complexity, requirement only for user interaction, and impact across confidentiality, integrity, and availability. The broad reach of Chrome across consumer and enterprise systems and the web-based attack delivery mechanism make it a natural target for threat actors. Although not yet on the KEV list, the ease of exploitation and potential for mass campaigns warrant immediate patching.

Risk score, explained

The CVSS 3.1 score of 8.8 (High) reflects a network-accessible vulnerability requiring only user interaction, with no special privileges needed. The attack results in complete compromise of the affected process (high confidentiality, integrity, and availability impact). The principal limiting factor is the requirement for user interaction; without it, this would be a critical-severity issue. The absence of attack complexity mitigations and the inherent trustworthiness users grant to browser content elevate the practical risk.

Frequently asked questions