Google Chrome EUVD-2026-66072

The victim must actively visit a crafted HTML page - passive exploitation without navigation is not possible per the UI:R CVSS metric. Per the CVSS vector (PR:N), no authentication to the attacker's site or to Chrome itself is required from the attacker's side. Exploitation is limited to contexts where the victim's Chrome browser can load WebXR-related content; platforms or configurations where WebXR is explicitly disabled or blocked by enterprise policy would reduce exposure. The attack does not require any pre-existing foothold on the victim system. Scope is unchanged (S:U), meaning the attacker cannot leverage this vulnerability to break out of the Chrome renderer sandbox or affect other processes - impact is confined to information readable within the Chrome content process.

CVSS 3.1 scores this at 6.5 (Medium), driven by AV:N/AC:L/PR:N/UI:R and C:H/I:N/A:N - a low-friction network attack requiring only user interaction, with no privileges needed, but limited to confidentiality impact and no scope change. This contrasts with Chrome's own 'Low' internal severity rating, likely reflecting limited exploitability of the leaked data in practice. EPSS at 0.17% (7th percentile) confirms no meaningful exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV, so no confirmed active exploitation exists. The disconnect between CVSS C:H and Chrome's Low rating suggests the leaked information, while sensitive in principle, may be of limited attacker utility - possibly restricted to WebXR session metadata or sensor readings rather than authentication credentials or cross-origin page content. POC status is unknown; no exploit code is referenced in the provided data. Overall, this is a real but low-urgency finding: update Chrome as part of routine patch cadence rather than treating it as an emergency.

An attacker hosts a malicious HTML page containing crafted WebXR API calls designed to trigger the information leak - for example, by enumerating XR device state or reading cross-origin data exposed through the XR subsystem. A victim using a vulnerable Chrome version visits the page (via phishing link, malicious ad, or compromised site), and the attacker's JavaScript silently exfiltrates the leaked information back to the attacker-controlled server. No public POC is referenced in the available data.