CVE-2026-10021: Insufficient validation of untrusted input in USB in Google Chrome prior to 148

Synopsis

Insufficient input validation in the USB handling component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code. The attack is reachable over the network but requires the victim to visit a crafted HTML page; no authentication or account is needed on the attacker's side. Successful exploitation gives the attacker full code execution in the context of the browser process, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable from or navigable to an attacker-controlled origin.

• AuthenticationNot required

  No account or credentials on any system are required; the attacker only needs to serve a malicious page to the victim.

• Victim interactionRequired

  The victim must visit (or be redirected to) the attacker-crafted HTML page, making this a social-engineering or drive-by-navigation attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special timing constraints, race conditions, or environmental prerequisites beyond getting the victim to load the page.

Blast Radius

• A successful attacker achieves arbitrary code execution inside the Chrome browser process on the victim's machine.
• With high confidentiality impact, the attacker can read browser-stored data including cookies, saved passwords, and session tokens.
• With high integrity impact, the attacker can write or modify files and data accessible to the browser process.
• With high availability impact, the attacker can crash or otherwise disable the browser, disrupting the user's session and any browser-dependent workflows.