EUVD-2026-66072
GHSA-g28g-2mf9-5jfc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted web page requires victim interaction but no attacker authentication; impact is confidentiality-only with no integrity or availability effect and no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Information leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Information leak in Google Chrome's XR (WebXR) subsystem allows unauthenticated remote attackers to obtain sensitive browser-context information when a victim visits a crafted HTML page. All Chrome desktop versions prior to 152.0.7977.65 are affected, with the vendor classifying severity as Low internally despite a CVSS 3.1 base score of 6.5 driven by high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively visit a crafted HTML page - passive exploitation without navigation is not possible per the UI:R CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this at 6.5 (Medium), driven by AV:N/AC:L/PR:N/UI:R and C:H/I:N/A:N - a low-friction network attack requiring only user interaction, with no privileges needed, but limited to confidentiality impact and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious HTML page containing crafted WebXR API calls designed to trigger the information leak - for example, by enumerating XR device state or reading cross-origin data exposed through the XR subsystem. A victim using a vulnerable Chrome version visits the page (via phishing link, malicious ad, or compromised site), and the attacker's JavaScript silently exfiltrates the leaked information back to the attacker-controlled server. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which contains the vendor-released patch for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today