Google Chrome EUVD-2026-50931

Exploitation requires the victim to use Google Chrome prior to version 151.0.7922.72 and actively navigate to an attacker-controlled HTML page - user interaction is mandatory (UI:R). The WebXR API must be accessible, which is the default in Chrome but requires a secure context (HTTPS delivery of the attacker page). No attacker-side authentication is required (PR:N). Exploitation is constrained by the need to induce victim navigation (not automatable per SSVC), the requirement for a modern Chrome version with WebXR support, and the fact that the specific memory contents disclosed are not guaranteed to include high-value data such as credentials or session tokens. The absence of integrity and availability impact (I:N/A:N) limits the attack to information gathering rather than direct system compromise.

The CVSS 3.1 base score of 6.5 is driven by network accessibility (AV:N), low complexity (AC:L), no required privileges (PR:N), and high confidentiality impact (C:H), but requires user interaction (UI:R). Secondary signals substantially lower real-world urgency: EPSS at 0.16% (6th percentile) reflects very low observed exploitation probability historically. SSVC rates exploitation as none, automatable as no, and technical impact as partial - all pointing toward limited attacker interest and operational friction. Chromium's own internal severity of Low further suggests the C:H metric reflects a theoretical worst-case memory leak rather than a reliable path to high-value data. No KEV listing confirms no observed active exploitation. This is a classic high-CVSS-but-low-real-risk profile: the score overrepresents urgency relative to actual threat actor activity. Patch through normal update cadence.

An attacker crafts an HTML page that invokes the WebXR API in a manner that triggers the inappropriate implementation flaw, causing the Chrome renderer process to return memory contents into attacker-accessible JavaScript. The victim is directed to the page via a phishing link or malicious advertisement and must actively load it in an unpatched Chrome browser. No public proof-of-concept code has been identified, and SSVC rates the attack as not automatable, suggesting meaningful development effort is required to reliably weaponize the flaw.