CVE-2026-78962: Google Chrome WebXR Information Disclosure

CVE-2026-78962 Overview

CVE-2026-78962 is an uninitialized resource vulnerability in the WebXR component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who convinces a user to visit a crafted HTML page can potentially leak cross-origin data. Exploitation requires user interaction and social engineering, which limits automated mass exploitation. The issue is tracked under CWE-908: Use of Uninitialized Resource and was addressed in the Chrome Stable channel update. Google classified the Chromium security severity as Medium.

Critical Impact
Successful exploitation may expose cross-origin data from other browsing contexts, undermining the same-origin policy that isolates web application data.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable WebXR implementation
Desktop Chrome Stable channel builds released before the fix

Discovery Timeline

2026-08-25 - CVE-2026-78962 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78962

Vulnerability Analysis

The vulnerability resides in Chrome's WebXR implementation, the browser subsystem that exposes virtual and augmented reality device data to web applications. WebXR handles device pose, camera, and rendering buffers that must be initialized before being returned to JavaScript contexts. When a resource is used before initialization, the returned memory can contain residual data from prior allocations. An attacker who hosts a crafted HTML page and lures a victim into visiting it can read this uninitialized content through WebXR APIs. Because browser processes handle data from multiple origins, the leaked bytes may contain sensitive cross-origin information such as fragments of other pages, tokens, or rendered pixel data.

Root Cause

The root cause is improper initialization of a WebXR resource before it is exposed to script, aligning with CWE-908. Chrome allocates buffers or handles for XR device data but fails to zero or fully populate them prior to first read. JavaScript running on the attacker page then observes stale memory contents.

Attack Vector

Exploitation requires the victim to navigate to an attacker-controlled page and interact with the WebXR content, typically by accepting an XR session prompt. The attacker then invokes WebXR APIs on the crafted page and inspects returned resources for residual data. No authentication is required, but the social-engineering requirement raises the practical barrier. Full technical details are available in the Chromium Issue Tracker #524822825 once access restrictions are lifted.

No public proof-of-concept or exploit code is currently available for CVE-2026-78962. See the Google Chrome Release Update for vendor-published details.

Detection Methods for CVE-2026-78962

Indicators of Compromise

Chrome browser processes running versions below 152.0.7977.65 in enterprise inventories
Outbound connections from user endpoints to unfamiliar domains hosting WebXR content shortly after clicking a link
User reports of unexpected XR permission prompts on non-XR web content

Detection Strategies

Inventory browser versions across endpoints and flag Chrome installations below the patched build
Correlate web proxy logs with browser telemetry to identify visits to pages invoking WebXR APIs from low-reputation domains
Review endpoint EDR telemetry for Chrome renderer processes loading XR device modules on hosts without XR hardware

Monitoring Recommendations

Enforce browser version reporting through management tools such as Chrome Browser Cloud Management
Monitor phishing and social-engineering campaigns delivered via email or messaging that link to interactive WebXR demos
Track threat intelligence feeds for public proof-of-concept disclosures tied to Chromium issue 524822825

How to Mitigate CVE-2026-78962

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binary is loaded into memory
Verify Chromium-based browsers such as Edge, Brave, and Opera have absorbed the upstream fix

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Release Update for the full advisory. Enterprise administrators should push the update through group policy, MDM, or Chrome Browser Cloud Management. Confirm the installed version by navigating to chrome://settings/help.

Workarounds

Disable WebXR by setting the WebXRImmersiveArEnabled and related enterprise policies to disallow XR sessions where not required for business use
Restrict WebXR permissions through the DefaultWebXrSetting policy set to block sessions
Train users to reject XR session prompts from untrusted sites and avoid clicking links from unsolicited messages

bash

# Configuration example: Chrome enterprise policy to block WebXR (Linux path shown)
# /etc/opt/chrome/policies/managed/webxr-policy.json
{
  "DefaultWebXrSetting": 2,
  "WebXrImmersiveArEnabled": false
}