CVE-2026-17892: Google Chrome WebXR Info Disclosure Bug

CVE-2026-17892 Overview

CVE-2026-17892 is an information disclosure vulnerability in the WebXR component of Google Chrome. Versions prior to 151.0.7922.72 contain an inappropriate implementation that allows a remote attacker to obtain potentially sensitive information from process memory. Exploitation requires a victim to visit a crafted HTML page. Google classifies the Chromium security severity as Medium.

Critical Impact
A remote attacker can leak sensitive data from Chrome process memory by luring a user to a malicious page that abuses the WebXR API.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the affected WebXR implementation
Any platform (Windows, macOS, Linux) running the vulnerable Chrome build

Discovery Timeline

2026-07-30 - CVE-2026-17892 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17892

Vulnerability Analysis

The flaw resides in Chrome's WebXR implementation, the browser API that exposes virtual and augmented reality device data to web content. An inappropriate implementation permits a remote attacker to read data that should remain isolated inside the renderer or GPU process memory. The attacker delivers the exploit through a crafted HTML page that invokes WebXR interfaces in an unintended sequence or with unexpected parameters.

Information disclosure vulnerabilities of this class typically expose uninitialized buffers, adjacent heap contents, or pointer values that undermine address space layout randomization. Attackers commonly chain such primitives with a memory corruption bug to achieve reliable code execution. The Chromium project rates the issue as Medium severity, reflecting the requirement for user interaction and the bounded scope of the leaked data.

Root Cause

The root cause is an inappropriate implementation within the WebXR API surface. Chromium's public issue tracker records the defect under Chromium Issue 524822998. Full technical details remain restricted pending broader patch adoption.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page that invokes WebXR calls to trigger the disclosure. When the victim visits the page in an unpatched Chrome build, the crafted content extracts memory contents from the browser process and exfiltrates them to attacker-controlled infrastructure. No verified proof-of-concept code is publicly available. Refer to the Google Chrome Desktop Update advisory for release-level context.

Detection Methods for CVE-2026-17892

Indicators of Compromise

Outbound HTTPS traffic from Chrome processes to newly registered or low-reputation domains immediately following WebXR API activity.
Browser telemetry showing repeated WebXR session initialization from unfamiliar origins.
Endpoint records of Chrome processes with version strings below 151.0.7922.72 in enterprise fleets.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build earlier than 151.0.7922.72.
Monitor web proxy logs for pages that request the WebXR permission from domains outside a corporate allowlist.
Correlate Chrome renderer crash reports with visits to untrusted origins to identify probing attempts.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to detect version drift and anomalous navigation patterns.
Alert on execution of Chrome binaries that do not match the approved patched version baseline.
Track DNS and TLS SNI records for domains delivering WebXR content and enrich with threat intelligence.

How to Mitigate CVE-2026-17892

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Restart Chrome after the update to ensure the vulnerable renderer processes are terminated.
Audit third-party Chromium-based browsers and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed the issue in Chrome Stable 151.0.7922.72. Details are published in the Google Chrome Stable Channel Update. Enterprises using managed deployment should push the update through Google Update, MDM, or their software distribution platform.

Workarounds

Disable the WebXR API through enterprise policy on endpoints that do not require XR functionality.
Restrict access to untrusted websites through browser isolation or DNS filtering until patching completes.
Enforce site isolation and strict same-origin policies to reduce the practical impact of memory disclosure.

bash

# Configuration example: disable WebXR via Chrome enterprise policy (Linux)
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable-webxr.json
{
  "WebXRImmersiveArEnabled": false,
  "URLBlocklist": ["*://*/*webxr*"]
}
EOF