An attacker can trick a user into visiting a malicious web page that exploits a weakness in Chrome’s WebUSB policy enforcement. The crafted page can read sensitive data from the browser’s process memory, giving the attacker confidential information. The vulnerability maps to weaknesses in policy enforcement and protection mechanisms, and the risk is centered on confidentiality loss.

Google Chrome versions before 146.0.7680.178 on all major operating systems (Windows, macOS, Linux). Users running these pre‑patched releases are at risk.

The CVSS score of 6.5 indicates a moderate to high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Exploitation requires a user to open a crafted web page that requests WebUSB access, after which the attacker can read memory. Because it is a remote flaw accessed through a web interface, user awareness and timely updates are critical.