CVE-2026-17823: Google Chrome WebXR Auth Bypass Vulnerability

CVE-2026-17823 Overview

CVE-2026-17823 is an insufficient policy enforcement vulnerability in the WebXR component of Google Chrome. Versions prior to 151.0.7922.72 fail to correctly enforce the same-origin policy when handling WebXR content. A remote attacker can bypass same-origin protections by serving a crafted HTML page to a target browser. Chromium rates the security severity as Medium.

The flaw affects the desktop stable channel of Chrome and requires no authentication. Exploitation depends on user interaction, specifically visiting an attacker-controlled page. Successful exploitation lets malicious origins access resources or data that should be restricted by the same-origin policy.

Critical Impact
A crafted HTML page can bypass the browser's same-origin policy through the WebXR interface, exposing cross-origin data to attacker-controlled scripts.

Affected Products

Google Chrome (Desktop) versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected WebXR implementation
Downstream distributions bundling the pre-patch Chromium release

Discovery Timeline

2026-07-30 - CVE-2026-17823 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17823

Vulnerability Analysis

The vulnerability resides in Chrome's WebXR Device API, which exposes virtual and augmented reality capabilities to web content. WebXR sessions handle sensitive data streams including pose information, spatial mapping, and rendered content across origins. The same-origin policy [SOP] is the browser's foundational isolation boundary between web origins.

In affected versions, WebXR does not correctly apply origin checks on specific operations or resources exposed through the API. A page loaded from origin A can leverage the WebXR pathway to access or influence content that should be scoped to origin B. This weakens the guarantees the browser provides for cross-origin isolation.

The issue is a policy enforcement bug rather than a memory safety flaw. Exploitation does not require corrupting memory or achieving code execution. It relies on manipulating WebXR API interactions through standards-compliant JavaScript delivered by an attacker-controlled HTML document.

Root Cause

The root cause is missing or incorrect origin validation within the WebXR component of the Chromium renderer. Consult the Chromium Issue Tracker Entry for implementation-level details once the bug is unrestricted.

Attack Vector

The attack vector is remote and browser-based. An attacker hosts a crafted HTML page that invokes WebXR APIs in a manner triggering the policy bypass. When a victim visits the page, the attacker's script can reach data or interfaces belonging to another origin. No credentials or elevated privileges are required on the target system.

Code-level exploitation details are not available in the public advisory. Refer to the Google Chrome Update Announcement for the vendor's release notes.

Detection Methods for CVE-2026-17823

Indicators of Compromise

Browser telemetry showing Chrome versions below 151.0.7922.72 in the fleet
Web proxy logs recording navigation to untrusted pages that initiate WebXR sessions (navigator.xr.requestSession)
Unexpected cross-origin fetches or postMessage traffic originating from pages that also use WebXR APIs

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.72
Inspect HTTP responses for HTML pages requesting immersive-vr or immersive-ar sessions from low-reputation origins
Correlate browser process telemetry with outbound network requests to identify anomalous cross-origin data access following WebXR activity

Monitoring Recommendations

Enable browser update compliance reporting through enterprise management tooling
Log and review chrome://version output during endpoint health checks
Alert on execution of browser child processes launched with WebXR-related feature flags on unpatched hosts

How to Mitigate CVE-2026-17823

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after update to ensure the patched renderer is loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the fixed Chromium version

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Update Announcement. Upgrade to Chrome 151.0.7922.72 or newer to remediate the WebXR policy enforcement flaw.

Workarounds

Disable WebXR in enterprise policy by setting WebXRImmersiveArEnabled and related policies to false where feasible
Restrict browsing to trusted origins using URL allowlists via Chrome enterprise policy
Deploy browser isolation for high-risk user groups until patch deployment completes

bash

# Enterprise policy example to disable WebXR immersive AR on managed Chrome installs
# Linux: /etc/opt/chrome/policies/managed/webxr.json
{
  "WebXRImmersiveArEnabled": false
}