CVE-2026-17823 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical weakness in the WebXR implementation within Google Chrome browsers, specifically affecting versions prior to 151.0.7922.72. The flaw resides in the insufficient enforcement of security policies that govern cross-origin resource access, creating a pathway for remote attackers to circumvent fundamental web security mechanisms. The same origin policy serves as a cornerstone of web security by preventing scripts from one origin from accessing resources from another origin without proper authorization, yet this vulnerability undermines that essential protection.
The technical nature of the flaw allows malicious actors to craft specially designed HTML pages that exploit gaps in the WebXR API's permission and access controls. WebXR, which enables immersive virtual and augmented reality experiences within web browsers, requires strict policy enforcement to prevent unauthorized access to device capabilities and data. When these policies fail to properly validate cross-origin requests, attackers can manipulate the browser's security model to gain unauthorized access to resources that should remain isolated. This type of vulnerability falls under CWE-693, which specifically addresses inadequate protection mechanisms in web applications where security controls are bypassed through various means.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to potentially access sensitive user data, device sensors, and other resources that should be protected by the same origin policy. In practical attack scenarios, an attacker could craft a malicious webpage that leverages the WebXR API to access information or capabilities that would normally be restricted to trusted applications. This creates a significant risk for users who browse untrusted websites, as simply visiting a compromised page could result in unauthorized access to their device's capabilities and personal data.
The medium severity classification from Chromium security team reflects the specific nature of the vulnerability where the bypass requires user interaction through visiting a malicious webpage rather than enabling automatic exploitation. However, this still represents a substantial risk given the widespread use of Chrome browsers and the potential for sophisticated social engineering campaigns that could lead users to visit malicious sites. The vulnerability aligns with ATT&CK technique T1059.001 which covers command and scripting interpreter usage, as attackers can leverage these browser-based exploits to establish persistent access or gather sensitive information.
Mitigation strategies should focus on immediate browser updates to versions 151.0.7922.72 and later, where the security policies have been strengthened to properly enforce same origin restrictions. Organizations should implement additional network-level protections such as content filtering and web application firewalls to detect and block suspicious WebXR-related requests. Browser administrators should also consider implementing stricter security policies through enterprise management tools that can further restrict WebXR capabilities in environments where the risk is higher. Additionally, user education about the dangers of visiting untrusted websites remains crucial, as this vulnerability specifically relies on social engineering to deliver malicious payloads that exploit the browser's security model.