CVE-2026-79125: Google Chrome XR Information Disclosure

CVE-2026-79125 Overview

CVE-2026-79125 is an information disclosure vulnerability in the WebXR component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can obtain sensitive information by convincing a user to load a crafted HTML page. The vulnerability maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. Google classifies the Chromium security severity as Low, while the NVD scoring reflects the network-reachable nature of the attack.

Critical Impact
A crafted web page loaded in an unpatched Chrome browser can leak sensitive in-process data to a remote attacker through the XR interface.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the same WebXR code path
Desktop Stable channel builds shipped before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79125 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79125

Vulnerability Analysis

The issue resides in Chrome's XR subsystem, which implements the WebXR Device API for immersive Virtual Reality (VR) and Augmented Reality (AR) sessions. WebXR exposes device pose, environment, and rendering data to web content. When the affected code path processes attacker-controlled inputs from a malicious page, it discloses memory or state that should not cross the web boundary.

The vulnerability requires user interaction: the victim must visit or be redirected to an attacker-controlled HTML page. No authentication is required, and the attack is delivered over the network. Successful exploitation impacts confidentiality only. It does not corrupt memory or grant code execution.

Root Cause

The root cause is improper handling of internal state within the WebXR component, allowing a script on a crafted page to read data outside the intended API surface. This matches the [CWE-200] pattern of exposing sensitive information to an unauthorized actor. Google has not published detailed root-cause information; restricted access to Chromium Issue #533001362 is standard practice until the patch has propagated.

Attack Vector

An attacker hosts or injects a crafted HTML page that invokes WebXR APIs in a specific sequence. When a user on an unpatched Chrome build loads the page, the script harvests leaked data and exfiltrates it to attacker infrastructure. Delivery channels include phishing links, malicious advertisements, and compromised sites. The vulnerability cannot be triggered without user-initiated navigation.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79125

Indicators of Compromise

Chrome browser processes making unusual outbound connections shortly after navigation to unfamiliar domains hosting WebXR content
HTTP responses containing HTML pages that invoke navigator.xr.requestSession() or related WebXR APIs from low-reputation origins
Endpoint telemetry showing Chrome versions below 152.0.7977.65 in active use across the fleet

Detection Strategies

Inventory Chrome installations and flag any instance running a build older than 152.0.7977.65
Correlate web proxy logs for pages referencing WebXR namespaces served from newly registered or uncategorized domains
Baseline normal WebXR usage in the environment; investigate deviations from that baseline

Monitoring Recommendations

Enable browser version reporting through enterprise management tooling to track patch compliance
Log DNS and HTTPS SNI data to identify user navigation to suspicious pages after phishing campaigns
Alert on child processes and network connections spawned by Chrome that deviate from established behavioral baselines

How to Mitigate CVE-2026-79125

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on all managed systems to ensure the patched binaries are loaded
Verify that Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Google Chrome Stable Update blog. The upstream tracking bug is Chromium Issue #533001362. Enterprises using managed Chrome deployments should push the update through Group Policy, Jamf, Intune, or equivalent management tooling.

Workarounds

Disable WebXR through enterprise policy where immersive VR/AR functionality is not required
Restrict access to untrusted sites using web filtering or DNS-layer controls until patching is complete
Enforce Site Isolation and standard Chrome hardening policies to limit the blast radius of untrusted web content

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Windows)
# HKLM\Software\Policies\Google\Chrome
# Value: MinimumRequiredVersion = 152.0.7977.65

reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumRequiredVersion /t REG_SZ /d "152.0.7977.65" /f