CVE-2026-78911: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the USB component of Google Chrome before version 152.0.7977.65. An attacker who has already compromised the renderer process and employs social engineering techniques may exploit this flaw to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The issue is rated with a CVSS 3.1 base score of 8.3, indicating high severity. There is no explicit vendor advisory text on remediation level, but the vulnerability is fixed in version 152.0.7977.65 as indicated by the affected versions and the referenced Chrome stable channel update blog post.

Successful exploitation could allow remote code execution outside the sandbox, leading to full compromise of the affected system. The attacker must have already compromised the renderer process and use social engineering to trigger the exploit. This elevates the risk of arbitrary code execution with high confidentiality, integrity, and availability impact.

Users should update Google Chrome to version 152.0.7977.65 or later to remediate this vulnerability. The vendor advisory linked confirms the availability of a stable channel update addressing this issue. No additional mitigation steps are indicated by the vendor advisory.