CVE-2026-79258: Google Chrome WebXR Auth Bypass Vulnerability

CVE-2026-79258 Overview

CVE-2026-79258 is an incorrect authorization vulnerability [CWE-863] in the WebXR component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page. Successful exploitation allows the attacker to obtain cross-origin data that should be inaccessible under the browser's same-origin policy. Google's Chromium project rated the security severity as Medium.

Critical Impact
Attackers can read cross-origin data from a victim's browsing session, bypassing same-origin protections through a malicious page delivered via social engineering.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
WebXR Device API component in Chromium
Chromium-based browsers that inherit the vulnerable WebXR implementation

Discovery Timeline

2026-08-25 - CVE-2026-79258 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79258

Vulnerability Analysis

The vulnerability resides in the WebXR implementation shipped with Chrome versions before 152.0.7977.65. WebXR is the browser API that exposes virtual and augmented reality devices to web content. The issue is classified as incorrect authorization [CWE-863], meaning the component performs an access-control check that does not correctly enforce the intended policy.

In this case, the flawed check permits a page from one origin to obtain data associated with a different origin through WebXR interfaces. Cross-origin isolation is a foundational browser guarantee, and any bypass allows an attacker to read information the requesting origin should never see. The Chromium team rated the severity as Medium because exploitation depends on user interaction driven by social engineering.

Root Cause

The root cause is an authorization check in the WebXR code path that fails to validate the requesting origin against the origin of the underlying resource. When the check is bypassed, WebXR returns data that crosses the origin boundary. Details are tracked in Chromium Issue Tracker #524418836.

Attack Vector

An attacker hosts a crafted HTML page that invokes WebXR APIs. The attacker persuades a victim to open the page, typically through phishing, malicious advertising, or a link in a compromised site. When the victim's Chrome instance renders the page, the incorrect authorization check allows the malicious origin to read cross-origin data. No memory corruption or code execution is required; the exploit relies purely on API misuse.

No verified proof-of-concept has been published. See the Chrome Stable Channel Update for the vendor bulletin.

Detection Methods for CVE-2026-79258

Indicators of Compromise

Chrome desktop clients reporting a version string below 152.0.7977.65 in browser telemetry or user-agent logs.
Outbound requests from user endpoints to unfamiliar domains that host pages invoking WebXR APIs.
Browser console errors or extension telemetry showing WebXR session requests from low-reputation origins.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 152.0.7977.65.
Inspect web proxy and DNS logs for user visits to newly registered domains immediately preceding suspicious data exfiltration events.
Correlate phishing email delivery events with subsequent browser navigation to attacker-controlled URLs.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM to maintain continuous version compliance visibility.
Alert on user reports of unsolicited WebXR permission prompts or VR-related pages on unrelated business workflows.
Track EPSS score drift for CVE-2026-79258 to reprioritize response if exploitation likelihood increases.

How to Mitigate CVE-2026-79258

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-close and restart Chrome after the update so the patched binary is loaded into memory.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed the issue in the Chrome Stable channel release 152.0.7977.65. Refer to the Chrome Stable Channel Update for release notes and to Chromium Issue Tracker #524418836 for the underlying bug record.

Workarounds

Enforce automatic Chrome updates through enterprise policy so patched builds deploy without user action.
Disable WebXR via enterprise policy or feature flag where VR and AR functionality is not required.
Train users to avoid opening unsolicited links that request virtual reality or immersive session permissions.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version