CVE-2026-13882: Race in USB in Google Chrome prior to 150

Synopsis

A use-after-free race condition in the USB handling code of Google Chrome prior to version 150.0.7871.47 can be reached by a remote attacker who has already compromised the Chrome renderer process. The attacker delivers a crafted HTML page over the network, requiring the victim to visit it, and no authentication is needed. Successful exploitation breaks out of the Chrome sandbox, giving the attacker code execution on the underlying host with full confidentiality, integrity, and availability impact. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No credentials or account are needed; the attack is initiated purely by the victim loading a page.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page, making this a social-engineering or malvertising delivery scenario.

• Attack complexityDetail

  The exploit is described as a race condition, meaning it depends on a timing window in the USB handling code, but the CVSS AC:L rating indicates the race is reliably winnable without special environmental conditions.

Blast Radius

• The attacker escapes the Chrome renderer sandbox and gains code execution in the context of the host process, breaking the primary isolation boundary Chrome relies on.
• With a sandbox escape achieved, the attacker can read arbitrary files and data accessible to the host user, including stored credentials, session tokens, and local documents.
• The attacker can write to or modify files, persistent storage, and system configuration accessible to the compromised user account.
• The attacker can crash, hang, or otherwise disrupt the Chrome process and any dependent services, or use the foothold to destabilize the broader host.