EUVD-2026-50630
GHSA-pqxg-9927-553c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes WebXR API
-
ExploitTrigger integer overflow / memory corruption
-
ExecutionExecute arbitrary code in renderer sandbox
-
Impact(requires separate escape for host compromise)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively browse to attacker-controlled content using a vulnerable Chrome build (before 151.0.7922.72) - UI:R in the CVSS vector confirms required user interaction, so this is not a zero-click or server-side attack. The specific trigger is crafted WebXR content in an HTML page, meaning the victim's Chrome must reach and render the malicious immersive-web/WebXR code path; environments that disable WebXR or block VR/AR APIs are not exploitable. Limiting factors: code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape is needed for host compromise; no authentication is required (PR:N) but user interaction is mandatory; and there is no active exploitation (not in KEV) or public PoC to lower the exploitation bar. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a low-complexity, unauthenticated network attack requiring user interaction (visiting a page), with high confidentiality, integrity, and availability impact but no scope change - consistent with the description's note that execution stays 'inside a sandbox.' Counterbalancing signals lower the real-world priority: Google's own Chromium severity is only Medium, EPSS is 0.22% (13th percentile), the vulnerability is NOT on CISA KEV, and no public exploit is identified. Scope:Unchanged is significant - because code runs inside the renderer sandbox, an attacker needs a separate sandbox-escape chain to achieve full system compromise, which this CVE alone does not provide. Net assessment: a genuine but not urgent issue for most environments - patch on the normal Chrome update cadence rather than as an emergency, while acknowledging WebXR's ubiquity means broad exposure if a reliable exploit later emerges. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebXR content and lures a victim running a pre-151.0.7922.72 Chrome build to visit it (via phishing link, malvertising, or a compromised site). When the page loads, the crafted WebXR data triggers the integer overflow / memory-corruption condition, giving the attacker arbitrary code execution inside the renderer sandbox. No public exploit is identified at time of analysis, and low attack complexity (AC:L) means a working exploit would be reliable, though full system compromise would require chaining a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later (Stable channel) and restart the browser to load the fix; managed fleets should confirm auto-update is enabled or push the update via enterprise policy. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, a targeted compensating control is to disable WebXR by setting the chrome://flags 'WebXR' / OpenXR runtime flags to Disabled or applying enterprise policy to block the WebXR/VR API and immersive-web content, which removes the vulnerable attack surface at the cost of breaking legitimate AR/VR web experiences (a low-impact trade-off for most enterprise users). Restricting untrusted browsing and ensuring the renderer sandbox remains enabled further limits impact until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebXR is the browser API that exposes virtual- and augmented-reality device data (pose tracking, immersive rendering) to web content, processing untrusted geometry and session parameters inside Chrome's renderer process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root-cause signals conflict: the CVE description names an integer overflow (a length/size miscalculation, CWE-190 in spirit), while the assigned CWE-416 (Use After Free) and the vendor tags ('Use After Free', 'Memory Corruption') point to a dangling-pointer dereference. In practice an integer overflow in a WebXR allocation/size computation can lead to undersized buffers and subsequent memory-corruption/UAF primitives, which is consistent with both signals. Exploitation yields code execution confined to the renderer sandbox, not a full host compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N) requires the victim to visit it (UI:R); renderer memory-corruption RCE gives full C/I/A but stays sandboxed, so S:U.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users face remote code execution risk from a WebXR implementation flaw (CVE-2026-17881, CVSS 8.8) affecting all versions prior to 151.0.7922.72, which could compromise browser sandbox protections when users visit malicious sites. The vulnerability requires only user interaction, creating enterprise-wide risk for Chrome deployments across the workforce. While current exploitation likelihood remains low at 0.2% EPSS, a vendor patch is immediately available and should be deployed without delay.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB