CVE-2026-106389

Executive Summary

CVE-2026-106389 is an incorrect authorization vulnerability (CWE-863) in the USB subsystem of Google Chrome affecting versions prior to 155.0.8059.39. A remote attacker can leverage social engineering to convince a victim into installing or interacting with a crafted Chrome extension, which then bypasses system access restrictions normally enforced around USB device access. The impact is a security-control bypass at the browser-to-OS boundary, rated Chromium security severity Medium, with no public PoC, exploit code, or CISA KEV listing currently observed.

Technical Analysis

CWE-863 (Incorrect Authorization) describes a failure to correctly enforce an access-control policy for a resource or operation. In this CVE, the affected resource is USB-related functionality as mediated by the Chrome browser. The NVD description states: "Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension."

Several facts can be stated directly from the source data:

• The flawed component is USB handling within Chrome.
• The weakness class is incorrect authorization — meaning a check that should gate an action is either missing, misapplied, or evaluated against the wrong principal.
• Exploitation requires a crafted Chrome extension. The extension is the vector by which the authorization defect is reached; the attacker is described as "remote."
• The attacker must use social engineering. This is consistent with the fact that installing an extension requires user action (the victim must be persuaded to install it). It is also consistent with ATT&CK T1204 (User Execution).
• Successful exploitation results in bypassing system access restrictions. In the context of WebUSB-class functionality, that means the extension is able to reach USB devices in a manner that the platform's normal permission/authorization model is intended to prevent.
• The severity is Medium, per Chromium's own rating.

What cannot be stated and must not be invented: the specific function, class, interface, permission string, or API entry point in the Chromium codebase that contains the flawed authorization check. The NVD description and CNA title do not name any function, file, endpoint, or parameter. No patch diff, commit hash, or Gerrit review is available from the provided sources (Patch Confidence 0/4). Accordingly, the precise code-level mechanism — whether the flaw lies in extension permission inheritance, in a device-access authorizing check, in cross-context privilege propagation, or elsewhere — is not derivable from the supplied data.

Attack surface summary: the attack surface is the browser's extension platform combined with its USB mediation layer. Two trust boundaries are involved — (1) the extension-to-browser boundary, where extension privilege should be constrained, and (2) the browser-to-operating-system boundary, where OS device-access restrictions should remain in force. The authorization defect permits a crafted extension to cross at least one of these boundaries in a way that is not intended.

No CVSS vector, EPSS score, or base score is available. No public PoC, Nuclei template, or exploit code exists in the tracked sources. No affected OSV packages are listed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-863) and the mechanisms named in the NVD description (USB, social engineering, crafted Chrome extension). No implementation-specific names are invented.

1. Reconnaissance / target identification. The attacker identifies victims who can be induced to install a browser extension. Because the flaw is reached through an extension, the attacker's reconnaissance focuses on user populations rather than network-reachable services. There is no scanning step: this is not a network-exploitable service vulnerability. Target selection is social, not technical.

2. Triggering the flaw class. The victim is socially engineered into installing the crafted Chrome extension. Once installed, the extension exercises USB-related functionality in Chrome. The incorrect authorization check fails to correctly constrain the extension's access, such that the extension is able to act on USB resources beyond what its intended permission set should allow. The precise permission string or API call involved is not disclosed in the source data.

3. Payload / execution method (vulnerability-class level). At the class level, the "payload" is the crafted extension itself and the privileged USB operations it performs after the authorization check is bypassed. Since the weakness is incorrect authorization rather than, for example, memory corruption, no code-execution primitive need be described: the bypass grants access the extension should not have. No specific code pattern or function name can be stated from the available description.

4. Post-exploitation impact. Per the description, the result is bypassing system access restrictions. The blast radius is bounded by what the mis-authorized USB access permits on the host — i.e., interaction with USB devices that the normal authorization model is designed to gate. The description does not detail additional impact (for example, whether the bypass leads to data exfiltration via a USB device, device reconfiguration, or escalation to broader host access), and no such detail should be assumed.

Preconditions: user interaction (extension installation) is mandatory, which is why the attacker is characterized as remote and reliant on social engineering, and why this maps to T1204 User Execution rather than to a remotely exploitable, unauthenticated network flaw.

Impact Assessment

Business impact centers on loss of a platform security control at the browser-to-OS boundary. Organizations that permit user-installed Chrome extensions, or that cannot enforce extension allow-listing, are exposed. Because exploitation requires social engineering, the realistic threat model is targeted phishing or pretexting that persuades an employee to install a malicious extension rather than opportunistic mass exploitation.

Affected systems: endpoints running Google Chrome versions prior to 155.0.8059.39, on any platform where Chrome mediates USB access. No specific operating system or platform is named in the source data.

Blast radius: scoped to the impacted endpoint and the USB devices reachable from it that are subject to the bypassed authorization checks. The description does not indicate lateral movement, domain-wide compromise, or server-side impact.

CVSS subscores cannot be enumerated because no CVSS vector or base score was published in the source data (score: N/A). Qualitatively, the mandatory user-interaction precondition (social engineering, extension installation) is the principal reason a Medium Chromium severity rating is plausible; the impact is an authorization bypass rather than direct code execution. EPSS has not been scored by FIRST.org, so no probability estimate is asserted. CISA KEV status is NO, and there is no evidence of exploit-in-the-wild in the provided data.

Detection Guidance

Detection strategy: because the trigger is a Chrome extension performing USB operations beyond its expected authorization, detection should focus on (a) Chrome extension installation events on endpoints, and (b) USB device-access activity attributable to Chrome or its extension processes. The rules below use only facts stated in or directly implied by the vuln data (Chrome, USB, extension, versions < 155.0.8059.39); no invented API names or function identifiers are used.

Sigma Rule

title: Chrome Extension Install Followed by USB Device Activity (CVE-2026-106389)
id: 6c1f9c2a-0000-4b00-8a00-cve2026106389
status: experimental
description: Detects installation of a Chrome extension on a host running a Chrome version prior to 155.0.8059.39, followed by USB device access activity, consistent with the incorrect-authorization USB bypass described in CVE-2026-106389.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106389
author: SOC Detection Engineering
date: 2026/01/01
tags:
  - attack.t1204
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
    TargetFilename|endswith:
      - '\Extensions\'
  selection_usb:
    Image|endswith:
      - '\chrome.exe'
  condition: selection_ext or selection_usb
falsepositives:
  - Legitimate extension installations and normal Chrome USB usage
level: medium

YARA Rule

rule CVE_2026_106389_Chrome_Extension_USB_Authorization_Bypass
{
    meta:
        description = "Indicative detection for crafted Chrome extension artifacts associated with CVE-2026-106389 (CWE-863 incorrect authorization in USB). Heuristic only; no PoC available."
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106389"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $manifest = "manifest_version" ascii wide
        $perm1 = "usb" ascii wide nocase
        $perm2 = "usbDevices" ascii wide nocase
        $perm3 = "serial" ascii wide nocase
        $ext  = ".crx" ascii wide

    condition:
        uint32(0) == 0x34327243 or
        ( $manifest and 1 of ($perm*) and $ext )
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106389 Possible Chrome Extension Download Referencing USB Permissions"; flow:established,to_server; http.user_agent; content:"Chrome"; http.uri; content:".crx"; http.uri; content:"usb"; nocase; classtype:policy-violation; sid:2026106389; rev:1; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106389;)

Elastic Detection

sequence by host.id with maxspan=10m
  [ file where file.path : "*\\Google\\Chrome\\User Data\\*\\Extensions\\*" and event.action : "creation" ]
  [ process where process.name : "chrome.exe" ]

Splunk SPL Query

index=endpoint (process_name="chrome.exe" OR file_path="*\\Google\\Chrome\\User Data\\*\\Extensions\\*")
| stats count min(_time) as first max(_time) as last by host process_name file_path user
| where count > 0
| convert ctime(first) ctime(last)

Wazuh OSSEC Rule

<group name="windows,chrome,cve-2026-106389,">
  <rule id="1063890" level="8">
    <decoded_as>json</decoded_as>
    <field name="file.path">\.crx$</field>
    <description>CVE-2026-106389: Chrome extension artifact created - possible USB authorization bypass staging</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
  <rule id="1063891" level="10">
    <if_sid>1063890</if_sid>
    <field name="file.path">Google\\Chrome\\User Data\\.*\\Extensions</field>
    <description>CVE-2026-106389: Chrome extension installed into user profile - verify legitimacy (USB authorization bypass)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Enforce a Chrome extension allow-list via enterprise policy so that only vetted extensions can be installed; block arbitrary user-installed extensions. Because exploitation requires a crafted extension, constraining extension installation directly removes the required vector.
• Restrict or disable USB device access in Chrome for the user population where it is not operationally required, reducing the reachable attack surface for the authorization bypass.
• Strengthen anti-phishing and social-engineering controls (email filtering, link/attachment inspection, user awareness) since the attack depends on persuading the victim to install an extension.
• Confirm the installed Chrome version and treat any version below 155.0.8059.39 as exposed.

2. Patch / upgrade steps

• Upgrade Google Chrome to 155.0.8059.39 or later as indicated by the NVD description.
• Verify the update on all endpoints (including managed and unmanaged devices) and confirm the running version via the browser's version information.
• No vendor advisory, commit reference, or CVE-specific patch URL is available in the provided data; consult Google's Chrome release channel notes to corroborate the fixed version.

3. Long-term hardening

• Adopt a default-deny extension policy and periodically audit installed extensions for unapproved USB- or hardware-access permissions.
• Enforce browser version management and rapid update windows through endpoint management.
• Monitor extension installation telemetry and correlate with USB device-access events for early detection of this class of abuse.
• Track CVE-2026-106389 for the appearance of a CVSS score, EPSS value, PoC, or CISA KEV addition; adjust risk posture when any of these materialize.

References

• NVD — CVE-2026-106389: https://nvd.nist.gov/vuln/detail/CVE-2026-106389
• Google Chrome Release Notes (stable channel; verify fix version 155.0.8059.39): https://chromereleases.googleblog.com/
• Chromium Security Severity Guidelines (severity rating context): https://www.chromium.org/developers/severity-guidelines/
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/

No threat actor campaign, exploit-in-the-wild evidence, or CISA KEV entry is associated with CVE-2026-106389 in the provided data. No public PoC, exploit code, or Nuclei template was observed.