Google Chrome CVE-2026-78962

Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 on a desktop platform with WebXR API support available. The CVSS UI:R metric confirms that active user interaction is mandatory: the victim must be socially engineered into navigating to an attacker-controlled HTML page, ruling out drive-by exploitation without any user action. The PR:N metric confirms no authentication to any service is required on the attacker's side. Exploitation is constrained to confidentiality impact only - an attacker cannot modify data or cause a crash. The use of WebXR is implicitly required by the vulnerable code path, meaning pages that do not invoke WebXR APIs will not trigger the flaw. Exploitation is further limited to partial, potentially non-deterministic data leakage rather than full memory disclosure.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects a meaningful but constrained risk profile: the attack is network-reachable and requires no authentication, but mandatory user interaction (UI:R via social engineering) and a limited confidentiality-only impact (C:L) cap the real-world severity. EPSS at 0.26% (18th percentile) is low, indicating limited exploitation interest in the threat-intelligence community. There is no CISA KEV listing and no known public proof-of-concept, reinforcing that this is not under active widespread exploitation. The vulnerability is best characterized as a medium-priority patch-and-move-on item: the impact is data leakage rather than code execution, and exploitation requires convincing a target to visit an attacker-controlled page. Given the ubiquity of Chrome and the possibility of targeted use in data-exfiltration scenarios, patching remains the correct response - but the combination of low EPSS, no KEV, and UI dependency means this does not warrant emergency response prioritization over higher-severity, lower-friction vulnerabilities.

An attacker crafts a malicious HTML page that invokes WebXR session APIs in a specific sequence designed to trigger a read of uninitialized memory within Chrome's WebXR implementation. The attacker distributes the link via phishing email or malicious advertisement to lure a victim running a pre-patch Chrome version into visiting the page. Upon page load and user interaction with the WebXR content, the uninitialized memory region - potentially containing fragments of cross-origin data such as authentication tokens or page content from another tab - is leaked back to the attacker's origin. No public proof-of-concept has been identified.