EUVD-2026-50618
GHSA-8qfc-8wf8-q4v5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page with abusive WebXR API calls
-
DeliveryDeliver URL to victim via phishing or malvertising
-
ExploitVictim opens page in Chrome prior to 151.0.7922.72
-
ExecutionWebXR parser reads beyond buffer boundary
-
ImpactSensitive renderer heap memory disclosed or tab crash induced
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit a crafted HTML page in a vulnerable version of Google Chrome prior to 151.0.7922.72 - passive network exposure alone is insufficient (UI:R). The WebXR Device API must be accessible in the browser, which is enabled by default in Chrome and requires no special configuration to enable. No authentication to any remote service is required by the attacker (PR:N in CVSS). Exploitation is bounded by: (1) mandatory user interaction - the victim must open attacker-controlled content; (2) the scope is unscoped (S:U), meaning impact is confined to the Chrome renderer process and does not directly affect the host OS or other browser processes; (3) no integrity impact is scored, limiting the attacker to memory disclosure or renderer crash rather than arbitrary code execution or data modification. Risk is elevated for users who frequently browse untrusted or novel web content, particularly immersive or XR-themed web experiences. |
| Impact | The CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) reflects a network-reachable flaw requiring no privileges and no special attack complexity, but mandating user interaction - the victim must actively visit a crafted page. High confidentiality and availability impacts are scored, while integrity is unaffected, consistent with a read-only memory flaw. Against this, EPSS at 0.18% (8th percentile) is notably low, indicating that exploitation in the wild is unlikely in the near term based on current threat intelligence. The vulnerability is not listed in CISA KEV and no public proof-of-concept code is referenced in the available data. The tags 'Information Disclosure' and 'Buffer Overflow' align with the expected behavior of CWE-125. In practice, this is a medium-urgency patch priority: the ubiquitous deployment of Chrome and the zero-privilege-required attack path make broad patching appropriate, but the UI:R gating, low EPSS, and absence from KEV mean this is unlikely to see mass opportunistic exploitation in the short window before auto-updates propagate. Organizations with strict browser control policies or user populations that frequently browse untrusted XR content should prioritize this patch accordingly. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebXR API invocations with malformed geometry or device data designed to trigger an out-of-bounds read in Chrome's WebXR subsystem. The attacker delivers the URL to a victim via phishing email, malicious advertisement, or a compromised website, and upon the victim loading the page in a vulnerable Chrome version, the renderer process reads memory beyond the intended buffer boundary, potentially leaking heap contents or crashing the renderer process. No public proof-of-concept code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will apply this in most consumer and managed deployments; verify the installed version via chrome://settings/help or enterprise management tooling. For organizations that cannot immediately deploy the update, a compensating control is to restrict or block access to WebXR-dependent web applications via web filtering or browser policy (e.g., disabling the WebXR Device API via enterprise policy flags where supported) - note this will break legitimate immersive web experiences and productivity tools that rely on WebXR. No other confirmed workarounds are available from the referenced data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebXR is the browser API that enables augmented and virtual reality experiences natively in the browser without plugins. The vulnerability resides in Google Chrome's implementation of this API (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is classified under CWE-125 (Out-of-Bounds Read), a memory safety flaw where code reads data from a memory address beyond the allocated buffer boundary. In a browser rendering context, such flaws are particularly consequential: the WebXR subsystem processes complex 3D scene graph and device input data, and malformed input values can cause the parser or geometry processor to index into adjacent memory regions. This can expose heap contents from the renderer process, which may include cached page data, credentials, or other sensitive user information, or trigger a renderer crash, manifesting as a tab crash rather than a full browser shutdown due to Chrome's sandboxed multi-process architecture.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Network-delivered via crafted HTML page requiring victim visit (UI:R, PR:N); read-only memory flaw yields high confidentiality and availability impact with no integrity vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A high-severity memory corruption bug in Chrome's WebXR implementation (CVE-2026-17869) enables remote attackers to harvest sensitive data from the browser process or trigger application crashes by directing users to malicious websites, affecting all Chrome installations below version 151.0.7922.72. Organizations with standard web-browsing populations face dual risks: potential data leakage and user disruption through tab crashes. Patch availability makes this a priority remediation despite low current exploitation probability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB