The vulnerability allows a remote attacker to exploit insufficient policy enforcement when a USB device is connected, enabling privilege escalation through a crafted HTML page. The weakness essentially permits an attacker to gain elevated privileges or bypass controls, aligning with CWE-269 and CWE-280. The potential outcome is that the attacker could take full control of the user’s browser session, masquerading as the user or manipulating the browser state. This flaw does not directly compromise the underlying operating system but could serve as a foothold for broader attacks if other system resources are accessed.

Google Chrome browsers built on Chromium prior to version 151.0.7922.72 are affected. The problem exists for any installation that does not enforce USB access policies appropriately, impacting desktop users of Chrome on Windows, macOS, and Linux platforms. No specific hardware variants are mentioned, but the flaw could affect any device that can connect via USB to a Chrome‑enabled machine.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog, so there are no confirmed large‑scale exploitation incidents yet. Based on the description, the likely attack vector is a web page hosted or served to the user that triggers the USB policy check, requiring the user to navigate to the page. Because it is a remote, user‑initiated vector, the risk remains moderate, but the substantial impact warrants immediate attention.