Description
Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Mon, 06 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title WebHID Policy Bypass Enables Privilege Escalation via Malicious Chrome Extension

Mon, 06 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Google Chrome

Sun, 05 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Google Chrome

Sat, 04 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Chrome Extensions

Sat, 04 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Chrome Extensions

Fri, 03 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Title WebHID Privilege Escalation in Chrome via Malicious Extension

Thu, 02 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title WebHID Privilege Escalation in Chrome via Malicious Extension

Thu, 02 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Unsafe WebHID Extension in Chrome

Thu, 02 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Unsafe WebHID Extension in Chrome

Wed, 01 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Chrome
Weaknesses CWE-285
CWE-850

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Policy Bypass in Chrome
Weaknesses CWE-285
CWE-850

Wed, 01 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Extension in Google Chrome
Weaknesses CWE-284

Wed, 01 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via WebHID Extension in Google Chrome
Weaknesses CWE-284

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T03:55:28.608Z

Reserved: 2026-06-29T23:03:36.918Z

Link: CVE-2026-13864

cve-icon Vulnrichment

Updated: 2026-07-01T13:16:37.220Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-06T20:45:15Z

Weaknesses