Low CVSS 8.8 chrome Policy Bypass 🔧 Commit mapped

Overview

Low
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in HID
DescriptionInsufficient policy enforcement in HID
ComponentHID
Bug ClassPolicy Bypass
Tracker513169718
Fix commitada330bc2b00 (chromium/src) +1/-0
CWECWE-602
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-05-14 (per vendor advisory)
Fix landed2026-05-26 (public git)
Disclosed2026-06-30
Patch gap35 days — fix public in source before the advisory

Files Changed

  • services/device/public/cpp/hid/hid_blocklist.cc
From ada330bc2b0043c793c055732581c8ebdc1badd7 Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Tue, 26 May 2026 05:28:11 -0700
Subject: [PATCH] Call PopulateWithServerProvidedValues in HidBlocklist constructor

PopulateWithServerProvidedValues was only called in
ResetToDefaultValuesForTest, which seems to have been an oversight in
crrev.com/c/2587797. This meant that server-side additions to the WebHID
blocklist were never loaded in production builds.

Bug: 40135068
Change-Id: Ida332d9cbe2c5221198b6e2f3afebf838c37c64b
Fixed: 513169718
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7850315
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1636097}
---

diff --git a/services/device/public/cpp/hid/hid_blocklist.cc b/services/device/public/cpp/hid/hid_blocklist.cc
index 9943cdc12..74b6ea69 100644
--- a/services/device/public/cpp/hid/hid_blocklist.cc
+++ b/services/device/public/cpp/hid/hid_blocklist.cc
@@ -397,6 +397,7 @@
   for (const auto& entry : kStaticEntries)
     DCHECK(IsValidBlocklistEntry(entry));
 #endif
+  PopulateWithServerProvidedValues();
 }
 
 }  // namespace device
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.