This vulnerability (CVE-2026-13864) affects Google Chrome versions before 150.0.7871.47 and stems from insufficient policy enforcement in the WebHID API. An attacker who persuades a user to install a crafted malicious Chrome extension can exploit this flaw to perform privilege escalation. The issue is categorized under CWE-284 (Improper Access Control). The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Although the vulnerability is publicly disclosed, the vendor advisory does not explicitly confirm the availability of a patch or fix.

Successful exploitation allows privilege escalation via a malicious Chrome extension, potentially compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.1) reflects significant impact if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when installing Chrome extensions and only install extensions from trusted sources.