EUVD-2026-50745
GHSA-9hh3-vfmx-fj86
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page (AV:N), no attacker privileges needed (PR:N), user must visit the page (UI:R), memory read yields high confidentiality loss (C:H), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Technical ContextAI
WebXR is a browser API enabling augmented and virtual reality experiences directly within web content. The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels), meaning the root cause is an observable behavioral or timing artifact in the WebXR subsystem that permits an attacker to infer process memory contents without direct memory access. This class of flaw exploits measurable differences in execution time, cache state, or resource utilization rather than a classic memory corruption primitive. The affected product is Google Chrome across all platforms as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the vulnerability present in all versions before 151.0.7922.72.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed enterprise environments, prioritize deployment via Chrome Browser Cloud Management or Group Policy to enforce the minimum version. As a short-term compensating control prior to patching, disabling WebXR access via enterprise policy (restricting the WebXR API through Chrome's content settings or enterprise policy ChromeWebXREnabled if available) would eliminate the attack surface, though this will break any legitimate WebXR applications in use. Browser isolation technologies (e.g., mandatory use of Site Isolation profiles) may reduce but cannot fully eliminate side-channel memory leakage risks. No alternative workaround eliminates the vulnerability without restricting the WebXR feature.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today