EUVD-2026-30406
GHSA-fh3c-f7qc-x6w8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; PR:N is correct as no application authentication is required; C:H captures process memory exposure with zero integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
WebXR policy enforcement failure in Google Chrome for Android (prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage information-disclosure primitive, not a standalone initial-access vector - exploitation requires chaining with a prior renderer compromise. No active exploitation is confirmed: CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at 0.04% (14th percentile), collectively indicating low real-world exploitation pressure.
Technical ContextAI
WebXR is Chrome's implementation of the WebXR Device API, enabling immersive augmented and virtual reality experiences directly in the browser. CWE-693 (Protection Mechanism Failure) identifies the root cause as an incomplete or bypassable security policy within Chrome's WebXR subsystem on Android. Chrome's renderer process is supposed to be sandboxed and confined by strict inter-process policies; when those policies are insufficiently enforced around WebXR, a compromised renderer gains unauthorized read access to adjacent process memory regions. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms this applies to Google Chrome broadly, but the description and EUVD scope it specifically to the Android platform for versions below 148.0.7778.168. Tags associating Red Hat and SUSE suggest downstream Linux packaging ecosystems may also track this, though the Android-specific framing is authoritative per the CVE description.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.168 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. On Android, Chrome updates are delivered through the Google Play Store and can be applied via the device's app update mechanism. No documented workaround is provided by the vendor. As a compensating control for environments where immediate patching is not possible, disabling WebXR via Chrome enterprise policy (if the deployment supports Chrome Enterprise) would eliminate the attack surface for this specific flaw, at the cost of breaking any WebXR-dependent applications or intranet pages. Note that this mitigation only addresses this vulnerability, not the underlying renderer compromise risk that is a prerequisite for exploitation.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today