Google Chrome CVE-2026-17892

The victim must be running Google Chrome for desktop in a version prior to 151.0.7922.72. The victim must navigate to a crafted HTML page (UI:R), meaning the attacker must successfully deliver the page via phishing, malvertising, or a compromised third-party site. The WebXR API must be accessible in the browser session, which it is by default in Chrome desktop builds. No authentication is required on the attacker side (PR:N). Exploitation is limited by: required user interaction to visit the malicious page; no reported automation pathway (SSVC: Automatable=no); and the attack is constrained to reading memory within the Chrome renderer process rather than the full system. Non-default WebXR disablement via enterprise policy would block this attack vector entirely.

The CVSS 3.1 base score of 6.5 reflects a network-reachable, low-complexity attack requiring only user interaction (UI:R) with no privileges needed, and a High confidentiality impact. However, multiple signals collectively reduce real-world urgency: EPSS is 0.18% at the 8th percentile, indicating the vulnerability is very unlikely to see widespread exploitation in the near term; SSVC rates exploitation as none and automatable as no, with only partial technical impact; the vulnerability is not listed in CISA KEV; and no public proof-of-concept has been identified. The High confidentiality rating is notable - process memory leakage can expose sensitive data such as credentials, tokens, or personal information rendered in the browser - but the requirement for user interaction (victim must navigate to a crafted page) and the absence of any automation pathway tempers mass-exploitation risk. This is a genuine patch priority but not an emergency response item absent evidence of targeted exploitation.

An attacker hosts a crafted HTML page that invokes the Chrome WebXR API in a manner that triggers the inappropriate memory access. The attacker then lures a victim running an unpatched version of Chrome to visit the page - via phishing email, malicious advertisement, or compromised website - after which JavaScript on the page reads back process memory contents and exfiltrates them to an attacker-controlled server. No public proof-of-concept code has been identified at time of analysis.