CVE-2026-13947: Google Chrome Information Disclosure Flaw

CVE-2026-13947 Overview

CVE-2026-13947 is an uninitialized memory use vulnerability [CWE-457] in the WebXR component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can read potentially sensitive information from process memory. Exploitation requires user interaction with a crafted HTML page and depends on prior renderer compromise, which raises attack complexity. Google classified the Chromium security severity as Medium and addressed the issue in the Stable channel update.

Critical Impact
An attacker with a compromised renderer can disclose sensitive memory contents from the Chrome process by delivering a crafted HTML page that triggers the XR code path.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based browsers embedding vulnerable WebXR code paths
Enterprise deployments pinned to older Chrome Stable builds

Discovery Timeline

2026-06-30 - CVE-2026-13947 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13947

Vulnerability Analysis

The vulnerability resides in Chrome's XR subsystem, which implements the WebXR Device API for virtual and augmented reality content. Chrome fails to initialize a memory region before reading from it during XR processing. When JavaScript in a compromised renderer invokes the affected XR code path, uninitialized bytes from process memory are exposed to attacker-controlled logic. The disclosed bytes may contain fragments of prior allocations, including pointers, tokens, or other sensitive data resident in the renderer address space. The issue is scoped to information disclosure and does not directly grant code execution or integrity impact.

Root Cause

The root cause is a use of uninitialized memory in the XR component, tracked under [CWE-457]. A buffer or structure used by the XR pipeline is read before all fields are assigned, returning residual heap or stack contents to the caller. See the Chromium Issue Tracker Entry for the upstream defect record.

Attack Vector

Exploitation requires two conditions. First, the attacker must already control the renderer process, typically via a separate vulnerability. Second, the victim must load a crafted HTML page that exercises the vulnerable XR API surface and requires user interaction. The high attack complexity reflects this prerequisite chain. Successful exploitation leaks memory contents that can support sandbox escape research, information gathering, or bypass of address space layout randomization.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.271%.

Detection Methods for CVE-2026-13947

Indicators of Compromise

Chrome renderer processes crashing or exhibiting anomalous memory access patterns while rendering XR content
Unexpected network requests exfiltrating binary blobs from pages using WebXR APIs
Browser telemetry showing use of navigator.xr APIs from untrusted origins immediately before renderer instability

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.47
Monitor endpoint logs for Chrome child processes with abnormal memory read patterns or crash signatures referencing XR modules
Correlate browser process telemetry with outbound traffic to identify potential post-exploitation data exfiltration

Monitoring Recommendations

Ingest browser and endpoint process telemetry into a centralized data lake and normalize with OCSF to enable cross-source correlation
Alert on Chrome versions that fall behind the vendor Stable channel by more than one release cycle
Track user navigation to pages that request XR permissions from unmanaged domains

How to Mitigate CVE-2026-13947

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Restart Chrome processes after the update to ensure the patched binary is loaded
Verify that enterprise auto-update policies are enabled and functioning as expected

Patch Information

Google released the fix in the Chrome Stable channel. Administrators should deploy 150.0.7871.47 or newer using enterprise update mechanisms. Refer to the Google Chrome Stable Update advisory for the full list of fixes bundled in this release.

Workarounds

Disable WebXR through enterprise policy or the WebXRImmersiveArEnabled and related policy controls where XR functionality is not required
Restrict access to untrusted sites via URL allowlisting until patch deployment completes
Enforce site isolation and strict sandbox settings to raise the cost of chaining a renderer compromise with this information disclosure

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on Linux endpoints
google-chrome --version

# Force update via enterprise policy (example GPO key)
# HKLM\Software\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60