EUVD-2026-50931
GHSA-8fm4-jx6q-6gmh
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N), no privileges needed (PR:N), user navigation required (UI:R); pure confidentiality impact with no integrity or availability effect (I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.
Technical ContextAI
The vulnerability resides in Chrome's WebXR implementation, the browser API enabling immersive VR and AR experiences through JavaScript. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as an inappropriate implementation - specifically, a failure to properly bound or sanitize memory access within the WebXR subsystem, allowing attacker-controlled page content to read adjacent process memory. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions prior to 151.0.7922.72 across Windows, macOS, and Linux. WebXR interfaces with hardware sensors and privileged browser internals, creating a wider-than-typical attack surface compared to standard DOM APIs; improper implementation in this layer can expose renderer process memory contents to JavaScript scope.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will handle this for most consumer deployments; enterprise administrators should verify the deployed version via fleet management or GPO-based Chrome update policies and confirm 151.0.7922.72 or above is present. As a compensating control before patching in environments where WebXR is not operationally required, disabling WebXR via Chrome enterprise policy (ExtensionSettings or managed preferences) eliminates the attack surface entirely, with the trade-off of breaking any browser-based AR/VR applications. Given the low EPSS score, SSVC exploitation rating of none, and Chromium's own Low severity classification, emergency out-of-cycle deployment is not warranted.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today