Google Chrome EUVD-2026-50745

Exploitation requires that the victim user visit an attacker-controlled web page and trigger interaction sufficient to activate the WebXR side-channel - consistent with CVSS UI:R. The WebXR API must be available and not blocked by enterprise policy or browser configuration. The attacker requires no authentication and no prior foothold; the attack is delivered entirely via the browser. Exploitation is limited by: (1) mandatory victim interaction - cannot be triggered silently or automatically without user action; (2) the attack is not automatable at scale per SSVC assessment; (3) side-channel leakage yields opportunistic memory fragments rather than targeted credential extraction; (4) all Chrome versions prior to 151.0.7922.72 on desktop are vulnerable regardless of operating system.

The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity, unauthenticated attack with high confidentiality impact - which sounds alarming in isolation. However, multiple signals substantially reduce the real-world risk priority. EPSS at 0.21% (11th percentile) indicates this is among the least likely vulnerabilities to see active exploitation in the near term. SSVC explicitly rates exploitation as 'none,' the attack is not automatable (UI:R is required - a victim must visit the attacker's page), and technical impact is rated only 'partial.' There is no CISA KEV entry and no public POC reported at time of analysis. The primary limiting factor is the mandatory user interaction requirement: the attacker cannot spray this at scale without social engineering. The confidentiality impact (C:H) may be overstated for practical purposes, as side-channel memory leakage typically yields fragments of data rather than targeted secrets. Overall, this is a genuine but lower-priority patch - important for Chrome fleet hygiene, but not an emergency response trigger.

An attacker hosts a malicious web page containing crafted WebXR content designed to elicit measurable side-channel signals from the Chrome rendering or XR process. When a user visits the page and triggers the WebXR session - for example, by clicking a 'Start VR experience' button - the attacker's JavaScript observes timing or cache-state artifacts to reconstruct fragments of process memory, potentially capturing sensitive data present in the process at that moment. No public proof-of-concept exploit has been reported at time of analysis.