EUVD-2026-50638
GHSA-vv96-3637-6hx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim navigates to malicious URL
-
ExploitPage invokes WebXR API with exploit sequence
-
ExecutionUninitialized memory read occurs in WebXR subsystem
-
PersistCross-origin data fragments leaked to page context
-
ImpactAttacker exfiltrates data to remote server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation requires the victim to actively visit an attacker-controlled or compromised web page (UI:R per CVSS vector), making purely passive or drive-by exploitation without any user navigation impossible. The victim must be running Google Chrome prior to version 151.0.7922.72 on any supported platform. The WebXR API must be reachable from the page context - while enabled by default in Chrome, enterprise Content Security Policies or feature-restriction policies could disable it, blocking exploitation. Impact is strictly bounded to partial cross-origin data disclosure (C:L); no code execution, privilege escalation, or availability impact is implied by the vulnerability class (CWE-457) or CVSS vector. Chrome's renderer sandbox limits what leaked data an attacker can exfiltrate even when exploitation succeeds. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) reflects a network-exploitable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) flaw that nonetheless requires user interaction (UI:R) and delivers only limited confidentiality impact (C:L) with zero integrity or availability impact. The EPSS score (0.20%, 10th percentile) strongly reinforces that mass exploitation is unlikely. There is no CISA KEV listing and no POC identified in available data. Chrome's renderer sandboxing architecture further constrains blast radius - even if cross-origin data is leaked, the attacker's ability to act on it is bounded by sandbox egress controls. Real-world priority is low for organizations with auto-update enabled, as patched versions would already be deployed. The primary residual risk is in managed enterprise environments with delayed update cycles. |
| Exploit ScenarioDerived | An attacker publishes a crafted HTML page that invokes the WebXR API in a sequence designed to trigger reads from uninitialized memory buffers, then uses JavaScript to exfiltrate the leaked bytes - potentially containing fragments of cross-origin content - back to an attacker-controlled server. The victim must navigate to this page in an unpatched Chrome browser for the attack to succeed. No public proof-of-concept exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later via the stable channel update documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed enterprise environments where immediate rollout is constrained, disabling WebXR via Chrome enterprise policy (setting WebXRImmersiveArEnabled to false through chrome://policy or GPO) eliminates the vulnerable code path entirely, at the cost of breaking legitimate WebXR/VR web applications for end users. Verifying that Chrome's automatic update mechanism is active and not suppressed by policy is the most operationally efficient mitigation for consumer and lightly-managed deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's WebXR implementation - the browser API (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) enabling immersive augmented and virtual reality experiences in-browser. CWE-457 (Use of Uninitialized Variable) identifies the root cause: memory allocated for WebXR operations is consumed before being properly zeroed or populated, leaving residual contents from prior allocations accessible. In a multi-origin browser context, such residual heap or stack data can include fragments of content from other origins, constituting a same-process cross-origin information leak. This class of bug is distinct from memory corruption - no code execution path is implied, only data exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-exploitable via crafted page (AV:N, PR:N) but requires user visit (UI:R); uninitialized memory leaks only partial cross-origin data (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB