CVE-2026-13910: Chrome WebXR Information Disclosure Flaw

CVE-2026-13910 Overview

CVE-2026-13910 is an insufficient policy enforcement vulnerability in the WebXR component of Google Chrome on Android. Versions of Chrome for Android prior to 150.0.7871.47 fail to enforce cross-origin protections in WebXR contexts. A remote attacker can craft a malicious HTML page that leaks cross-origin data when a user visits it. Google's Chromium team classified the security severity as Medium. The weakness is categorized under CWE-693: Protection Mechanism Failure.

Critical Impact
Attackers can leak cross-origin data from a victim's browser by luring them to a crafted HTML page that abuses WebXR policy gaps.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based mobile browsers inheriting the affected WebXR implementation
Android devices running vulnerable Chrome builds with WebXR enabled

Discovery Timeline

2026-06-30 - CVE-2026-13910 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13910

Vulnerability Analysis

The vulnerability resides in Chrome's WebXR Device application programming interface (API), which exposes virtual and augmented reality capabilities to web content. WebXR must strictly enforce the same-origin policy because it can surface sensor, spatial, and rendering data that reveal information about other origins or the device environment. In vulnerable Chrome for Android builds, policy enforcement checks are insufficient, allowing a page from one origin to obtain data associated with a different origin. The result is a cross-origin information disclosure reachable over the network with user interaction, such as visiting a crafted page. The flaw affects confidentiality without directly impacting integrity or availability. Successful exploitation requires the victim to load attacker-controlled HTML in a Chrome browser that supports WebXR on Android.

Root Cause

The underlying defect is a protection mechanism failure (CWE-693) within the WebXR feature. Origin and permission checks that gate access to XR session data are incomplete, letting a crafted page reach state or resources that should remain isolated to another origin. The fix ships in Chrome for Android 150.0.7871.47 and later.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page that invokes WebXR APIs in a manner that bypasses cross-origin restrictions. When a user browses to the page using a vulnerable Chrome on Android build, the page can extract cross-origin data. No authentication or elevated privileges are needed. Refer to the Chromium Issue Tracker Entry and the Chrome Desktop Update Announcement for vendor-provided details.

Detection Methods for CVE-2026-13910

Indicators of Compromise

Chrome for Android clients reporting a User-Agent version earlier than 150.0.7871.47 connecting to untrusted sites
Outbound requests from mobile browsers to newly registered domains hosting WebXR content
Web server or proxy logs showing repeated calls to WebXR-related JavaScript endpoints from a single mobile origin

Detection Strategies

Inventory Android endpoints and enumerate installed Chrome versions to flag builds below 150.0.7871.47
Inspect mobile browsing telemetry for HTML pages invoking navigator.xr or requestSession from low-reputation origins
Correlate mobile device management (MDM) browser version data with proxy logs to identify at-risk sessions

Monitoring Recommendations

Alert on Chrome for Android versions that fail to update within the standard patch window enforced by MDM
Monitor DNS and web proxy telemetry for domains associated with WebXR abuse or phishing campaigns targeting mobile users
Track unusual cross-origin data flows initiated by mobile browsers, particularly requests following visits to unfamiliar sites

How to Mitigate CVE-2026-13910

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Enforce automatic browser updates on managed Android devices using MDM policies
Advise users to avoid clicking untrusted links on mobile devices until patching is confirmed

Patch Information

Google addressed CVE-2026-13910 in Chrome for Android 150.0.7871.47. Consult the Chrome Desktop Update Announcement and the Chromium Issue Tracker Entry for the vendor advisory and fix references. Deploy the update fleet-wide and verify installed versions after rollout.

Workarounds

Disable WebXR through enterprise browser policy on Android where the feature is not required
Restrict access to sites requesting WebXR permissions using web filtering or MDM allow-listing
Provide user awareness guidance on avoiding untrusted HTML content on mobile Chrome until patched

bash

# Example Chrome enterprise policy to disable WebXR on Android via MDM
# Deploy as a managed configuration for com.android.chrome
{
  "WebXRImmersiveArEnabled": { "value": false },
  "DefaultSensorsSetting": { "value": 2 },
  "URLBlocklist": { "value": ["*"] },
  "URLAllowlist": { "value": ["https://*.corp.example.com"] }
}