{
  "id": 19102062,
  "title": "WebUSB, WebHID, and Web Serial need an origin-level device policy",
  "url": "https://urgent.news/2026/11/09/webusb-webhid-and-web-serial-need-an-origin-level-device-policy",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T06:01:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ioneyrezende/webusb-webhid-and-web-serial-need-an-origin-level-device-policy-4fk8"
  },
  "original_language": "en",
  "account": null,
  "summary": "The article discusses the need for an origin-level device policy for WebUSB, WebHID, and Web Serial APIs. These APIs allow web applications to access USB, human interface, and serial devices without a native installer, enabling hardware workflows. However, the device permission decision is moved into the web origin, which can be vulnerable to compromised scripts, third-party iframes, or overly broad feature policies. The browser mediates access through a user-mediation point, but it does not guarantee the trustworthiness of every script on the origin. The article suggests implementing permissions policies, such as \"usb\", \"hid\", and \"serial\", to control access to specific APIs. It also recommends using a deny-by-default header for pages that do not require device access and filtering the chooser where the browser supports filters. Additionally, the article advises testing iframe behavior from the same parent that runs in production and designing the device workflow as a capability, identifying the exact device class and operation.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}