How to Block HID Devices (Human Interface Devices) Globally in Chrome

The Peripheral Exploit

Google Chrome supports an advanced API known as WebHID (Web Human Interface Devices). This API allows websites to bypass the operating system’s standard input drivers and communicate directly with specialized physical peripherals plugged into your computer—such as advanced gaming gamepads, flight simulator yokes, and complex macro keyboards. While useful for browser-based cloud gaming, it is a significant hardware security vulnerability. Malicious websites can exploit this direct bridge to silently probe your attached peripherals or intercept raw keystroke data from macro pads. You must paralyze this API.

How to Block HID Device Access Globally

You can permanently sever the browser’s ability to see your specialized input hardware via Chrome’s Site Settings.

1. Open the Google Chrome desktop browser.
2. Click the three vertical dots (⋮) in the top right corner and select Settings.
3. In the left-hand sidebar, click on Privacy and security.
4. In the main window, click on Site settings.
5. Scroll down to the “Permissions” heading and click to expand Additional permissions.
6. Click on HID devices.
7. Under the “Default behavior” heading, select the radio button for “Don’t allow sites to connect to HID devices.”

Hardware Isolation

The change takes effect instantly. Google Chrome will completely sever its internal connection to your operating system’s raw HID driver stack. The browser is now permanently blind to the advanced capabilities of your physical gamepads and macro keyboards. If a website attempts to execute a WebHID script to scan your peripherals, the API call will instantly auto-reject in the background, returning a null value. This guarantees absolute physical isolation between unverified web code and your sensitive input hardware.