EUVD-2026-40635
GHSA-xgjj-rf26-5wm5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H captures mandatory renderer pre-compromise; C:H reflects process memory disclosure; I:N and A:N because only read access is demonstrated.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in Google Chrome's XR (Extended Reality/WebXR) subsystem exposes process memory to a remote attacker who has already achieved renderer process compromise. Affected versions are all Chrome releases prior to 150.0.7871.47. This is a second-stage, chained vulnerability - an attacker leverages a crafted HTML page to trigger the uninitialized read and extract sensitive data from process memory, but only after separately exploiting a renderer process escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a class of memory safety bugs where code reads from a memory region before it has been assigned a defined value, leaking whatever residual bytes happen to occupy that region. The affected component is Chrome's XR subsystem, which implements the WebXR Device API - a browser feature enabling immersive extended reality experiences (AR/VR) in web content. Chromium's multi-process architecture sandboxes web content in a renderer process isolated from the browser process; this vulnerability operates within the renderer. Affected CPE is all Chrome versions prior to 150.0.7871.47 on desktop platforms. The Chromium issue tracker reference (issues.chromium.org/issues/513280648) is the upstream bug record.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tools. The vendor advisory confirming the fix is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because this vulnerability requires a renderer process compromise as a prerequisite, organizations that cannot immediately patch can reduce combined chain risk by enforcing Chrome's Site Isolation policy (already enabled by default in modern Chrome), which limits cross-origin data accessible from a compromised renderer. Disabling WebXR via enterprise policy (WebXrEnabled=false in Chrome policy) would eliminate the specific attack surface at the cost of breaking any XR web applications in the environment. Blocking access to untrusted or unknown websites via web proxy or DNS filtering reduces the opportunity for an attacker to deliver the initial renderer exploit.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today