EUVD-2026-40696
GHSA-5v6g-3342-xc2g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), no authentication needed (PR:N), active visit required (UI:R), process memory exposed at high severity (C:H), no write or DoS impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in Google Chrome's WebXR subsystem on Android (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive contents from process memory by inducing a victim to visit a crafted HTML page. The root cause is CWE-457 (use of an uninitialized variable) within the WebXR implementation, meaning memory buffers are consumed before being properly zeroed or assigned, exposing whatever residual data the process held. No public exploit or CISA KEV listing is identified at time of analysis, but the CVSS C:H rating reflects the potential for meaningful data exposure including in-memory credentials, tokens, or browsing context.
Technical ContextAI
WebXR is the browser API that enables immersive augmented and virtual reality experiences directly in web content. Chrome's Android implementation handles WebXR session lifecycle and frame data in native code, where CWE-457 (use of uninitialized variable) indicates a code path that reads from a stack or heap buffer prior to any initialization assignment. On Android, Chrome runs in a sandboxed process model, but intra-process memory disclosure is still meaningful as the GPU or renderer process may hold session tokens, decoded media, or other sensitive in-flight data. The affected version range is Chrome on Android strictly below 150.0.7871.47, as identified by the EUVD entry EUVD-2026-40696. No CPE string was explicitly provided in the input, but the product is identifiable as Google Chrome for Android from the description and advisory references.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later. This is a vendor-released patch confirmed by the Chrome stable channel update advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Users should ensure Chrome auto-updates are enabled on Android devices via Google Play. As a compensating control prior to patching, disabling or restricting access to WebXR-capable pages (e.g., via enterprise policy or browser content restrictions) would eliminate the attack surface, though this disrupts legitimate XR web content. Organizations managing Android fleets via MDM should push the Chrome update immediately and verify version compliance. There are no known workarounds that fully mitigate the memory disclosure without updating.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today