CVE-2026-17889: Google Chrome WebXR Data Leak Vulnerability

CVE-2026-17889 Overview

CVE-2026-17889 is an uninitialized memory use vulnerability in the WebXR component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can craft a malicious HTML page to leak cross-origin data from a victim's browser. The Chromium project classified the security severity as Medium. The weakness is tracked under CWE-457: Use of Uninitialized Variable.

Critical Impact
Attackers can exfiltrate cross-origin data by luring users to a crafted webpage that exercises the vulnerable WebXR code path, bypassing the same-origin policy.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the affected WebXR implementation
Any downstream distributions built on the vulnerable Chromium release branch

Discovery Timeline

2026-07-30 - CVE-2026-17889 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17889

Vulnerability Analysis

The defect lives in Chrome's WebXR implementation, the browser API that exposes virtual and augmented reality device data to web content. WebXR handles device pose, session, and rendering data that flows between JavaScript and native graphics pipelines. An uninitialized use flaw in this code path allows memory contents that were never explicitly written to be returned to script or rendering primitives. Because that memory can contain residual data from other browsing contexts, an attacker-controlled page can observe cross-origin values it should not see.

Google disclosed the fix in the Chrome stable channel update, and the underlying defect is tracked in the Chromium Issue Tracker.

Root Cause

The root cause is classified as [CWE-457], the use of a variable or memory region before it has been assigned a defined value. In the WebXR flow, a structure or buffer is consumed by downstream logic without a guaranteed initialization step, exposing stale process memory to JavaScript-visible surfaces.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page invokes WebXR APIs in a sequence that triggers the uninitialized read and reflects the leaked bytes into a channel the attacker can observe, such as a canvas, texture, or JavaScript value. No authentication is required, and interaction is limited to visiting the page.

No public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for technical detail as it becomes public after the standard Chromium restriction window.

Detection Methods for CVE-2026-17889

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 observed in endpoint inventory.
Outbound connections from browser processes to unfamiliar domains immediately following WebXR session activity.
Web content invoking navigator.xr.requestSession() from low-reputation origins in browsing telemetry.

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across managed endpoints and flag any build below 151.0.7922.72.
Correlate browser process telemetry with proxy or DNS logs to identify users visiting pages that request WebXR sessions from unexpected domains.
Monitor for renderer process crashes or memory anomalies that coincide with WebXR API usage, which can indicate exploitation attempts.

Monitoring Recommendations

Enable browser management policies that report installed version and patch state to a central console.
Ingest web proxy logs into a SIEM and alert on requests to newly registered domains that serve WebXR content.
Track Chrome update deployment rate and set thresholds that escalate when patch coverage falls below policy targets.

How to Mitigate CVE-2026-17889

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart after update deployment to ensure the patched binary is loaded.
Audit Chromium-based third-party browsers and confirm each has merged the upstream fix.

Patch Information

Google released the fix in the Chrome stable channel update announced on the Chrome Releases blog. Users on 151.0.7922.72 or later are not affected. Enterprises managing Chrome through Group Policy, Jamf, or Intune should verify that auto-update is enabled and that the target version is enforced.

Workarounds

Disable WebXR through enterprise policy using the WebXRImmersiveArEnabled and related feature flags where supported until patching is complete.
Restrict access to WebXR-capable sites through web filtering categories for unmanaged or high-risk user groups.
Apply site isolation and strict cross-origin policies to reduce the value of any leaked memory contents.

bash

# Configuration example: enforce minimum Chrome version via policy (Linux example)
# /etc/opt/chrome/policies/managed/chrome_version_policy.json
{
  "TargetVersionPrefix": "151.0.7922.72",
  "DeviceAutoUpdateDisabled": false,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}