CVE-2026-9976: Inappropriate implementation in USB in Google Chrome prior to 148

Synopsis

An inappropriate implementation flaw in the USB subsystem of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code. The attacker reaches the vulnerability over the network without any authentication, but must convince a user to visit a crafted HTML page. Successful exploitation gives the attacker full code execution in the context of the browser process, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attacker sends the malicious page to any user without authenticating to the target.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions, race conditions, or memory-layout requirements on the attacker.

Blast Radius

• The attacker executes arbitrary code in the Chrome browser process on the victim's machine.
• Session tokens, saved credentials, and any data accessible to the browser process can be read directly.
• The attacker can write or modify files and browser state that the Chrome process has access to.
• The browser process can be crashed or rendered unresponsive, disrupting the user's session.