EUVD-2026-50772
GHSA-92f5-vrgr-rqhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver phishing link to victim
-
DeliveryVictim opens crafted HTML page in vulnerable Chrome
-
ExploitCrafted page invokes WebXR API with malicious parameters
-
ExecutionWebXR subsystem fails to enforce origin validation
-
PersistSame-origin policy boundary bypassed
-
ImpactAttacker script performs unauthorized cross-origin integrity violation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires the victim to actively visit a crafted HTML page using a vulnerable version of Google Chrome (prior to 151.0.7922.72), confirmed by the CVSS UI:R metric. The attacker requires no privileges (PR:N). The WebXR API must be available in the browser, which is the default in Chrome desktop releases. Exploitation is concretely limited by the requirement for victim interaction - passive drive-by exploitation is not possible without some form of navigation. Non-Chrome browsers are not in scope per CPE. The scope change is absent (S:U), meaning the SOP bypass does not inherently grant the attacker renderer escape or OS-level access; a chained exploit would be required for broader compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) characterizes a network-reachable, low-complexity attack that requires no attacker privileges but does require the victim to interact with a crafted page (UI:R). Impact is isolated to integrity (I:H), with no confidentiality or availability consequence and no scope change (S:U), meaning the attacker cannot escape the browser sandbox through this vulnerability alone. EPSS at 0.18% (8th percentile) indicates very low observed exploitation probability, which aligns with the absence of a CISA KEV listing and no identified public proof-of-concept. The 'Authentication Bypass' tag in the intelligence feed is misleading nomenclature - this is a same-origin policy bypass, not a traditional authentication control bypass. The realistic threat model is targeted phishing (crafted link delivered to a specific victim) rather than opportunistic mass exploitation. Chrome's auto-update mechanism substantially compresses the exposure window for consumer users; enterprise environments with controlled update schedules represent the more durable at-risk population. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that invokes the WebXR API in a manner that triggers the origin validation failure, then delivers the page URL to a victim via phishing email or compromised advertisement. When the victim opens the link in a vulnerable version of Chrome, the attacker's script bypasses the same-origin policy and performs cross-origin write or manipulation operations against another origin's content or state. No public exploit code has been identified, so successful exploitation currently requires custom exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed by vendor advisory to contain the fix for this WebXR policy enforcement flaw (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Most consumer Chrome installations update automatically via the built-in update mechanism; administrators managing enterprise deployments should verify update propagation through Chrome Browser Cloud Management or Group Policy and confirm the installed version via chrome://settings/help. As a compensating control where immediate patching is not feasible, enterprise administrators can disable WebXR access via the WebXrEnabled Chrome policy (set to false), which eliminates the attack surface entirely at the cost of breaking any legitimate XR web applications in the environment. Restricting navigation to untrusted external sites via proxy or browser filtering also reduces exposure given that user interaction is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebXR is the browser API enabling augmented and virtual reality experiences on the web, exposed through JavaScript in the renderer process. CWE-346 (Origin Validation Error) identifies the root cause: Chrome's WebXR subsystem fails to adequately validate the calling page's origin when enforcing same-origin policy controls, allowing cross-origin policy to be sidestepped. The same-origin policy is a foundational browser security boundary preventing scripts at one origin from interfering with resources at another. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects Google Chrome across all desktop platforms (Windows, macOS, Linux). The Chromium issue tracker reference (issues.chromium.org/issues/517628043) suggests the flaw was internally tracked and patched as part of Google's standard security release cycle, with severity rated Medium by the Chrome security team.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page (AV:N/AC:L); victim must visit it (UI:R/PR:N); SOP bypass yields high integrity impact (I:H) with no confidentiality or availability consequence and no scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB