Description

Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-25T21:17:52.287Z",
  "pubdate": "2026-08-25T21:17:52.287Z",
  "executiveSummary": "A critical vulnerability exists within the WebXR implementation of Google Chrome, specifically identified as an uninitialized resource issue. This vulnerability allows a remote attacker to potentially leak sensitive cross-origin data through a maliciously crafted HTML page.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65 and is categorized with a Medium security severity. The vulnerability represents an unauthorized information disclosure risk that undermines the browser's Same-Origin Policy (SOP).\nExploitation requires social engineering to direct a user to the attacker-controlled HTML page. Once triggered, the vulnerability allows the attacker to circumvent standard security boundaries, potentially exposing information across different origins that the user may be accessing simultaneously within the browser environment.\nGiven the nature of the exploit, the primary risk involves the unauthorized exfiltration of sensitive cross-origin data. Users of the affected software are urged to update to version 152.0.7977.65 or later to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability originates from an uninitialized resource condition within the WebXR component of the Chromium browser engine. In the context of browser security, uninitialized memory or resource states often occur when a specific object or buffer is allocated but not properly zeroed out or defined before being accessed by the application logic.\nIn this specific instance, the WebXR subsystem—which manages Extended Reality sessions within the browser—fails to ensure that certain resources are correctly initialized before they are interacted with by the rendering engine or associated JavaScript APIs.\nThe attack flow begins when an attacker uses social engineering tactics to lure a victim into navigating to a malicious web page hosting crafted HTML and JavaScript. Upon loading, the page initiates a WebXR session or interacts with WebXR-related APIs in a manner designed to trigger the uninitialized resource state.\nBecause the resource is uninitialized, subsequent read operations directed at this memory or object handle may return residual data from previous processes or unrelated contexts. If the memory contains sensitive cross-origin information—such as credentials, session tokens, or private user data previously stored in the browser's heap—the malicious script can read this data and exfiltrate it to an external server under the attacker's control.\nThis vulnerability effectively bypasses the browser's Same-Origin Policy (SOP), which is a foundational security mechanism designed to prevent one origin from accessing data belonging to another. By exploiting the memory safety issue, the attacker creates a bridge between the victim's secure browsing context and the attacker's malicious origin.\nThe vulnerability is persistent across all platforms where Google Chrome version 152.0.7977.65 is deployed, provided that the WebXR features are active. Exploitation does not require elevated privileges or local authentication on the victim's machine; it relies entirely on the successful execution of the crafted payload within the user's browser environment.\nThe post-exploitation impact involves the unauthorized disclosure of cross-origin data. Once exfiltrated, this data can be utilized for account takeover, session hijacking, or further targeted attacks against the victim's authenticated accounts. The reliance on WebXR suggests that the vulnerability may be triggered during the lifecycle management of XR sessions, specifically during transitions or error states where resource cleanup or initialization is improperly handled."
}