CVE Catalog
CVE-2026-13951
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk0.28%
20th percentile — higher than 20% of all known CVEs
Summary
Insufficient policy enforcement for USB in Google Chrome prior to 150.0.7871.47 allows a remote attacker who compromised the renderer process to potentially escape the sandbox via a crafted HTML page.
Risk Assessment
The risk for the organization is the potential bypass of browser isolation, leading to system access, data theft, or further privilege escalation.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later to remediate this vulnerability.
Original NVD description (English source)
Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)