CVE-2026-79258
Summary
by MITRE • 08/26/2026
Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the WebXR implementation of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser-level access controls for extended reality features. This issue stems from a failure in the permission model governing how web applications interact with hardware sensors and spatial tracking data required by the WebXR API. In a properly secured environment, requests to access sensitive device capabilities such as head pose, hand tracking, or room mapping must be explicitly authorized by the user through distinct prompts that clearly indicate which origin is requesting access. However, in this specific iteration of Chrome, the authorization logic failed to correctly validate whether the calling context was permitted to retrieve cross-origin data. This lapse allows a malicious web page operating under one domain to inadvertently receive spatial or device state information intended for a different, trusted domain, thereby violating the same-origin policy which is fundamental to browser security architecture.
The operational impact of this vulnerability relies heavily on social engineering tactics rather than purely automated exploitation techniques. An attacker must craft an HTML page that leverages WebXR APIs and entice a user into visiting it or interacting with its content in a manner that triggers the flawed authorization flow. Once the user is tricked, potentially through deceptive UI elements or misleading prompts that mimic legitimate system requests, the browser may grant access to cross-origin data without proper isolation. This can lead to information disclosure where sensitive environmental mapping data, which could reveal details about the physical location of the device owner such as home layout or office configuration, is exfiltrated by the malicious origin. The severity rating of Medium reflects that while the impact is significant regarding privacy and potential surveillance risks, it requires user interaction and does not allow for silent background exploitation without some form of social engineering component to bypass initial security warnings.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Authorization, as the system failed to enforce appropriate access controls on cross-origin requests. It also relates closely to CWE-359 regarding Exposure of Private Information to an Unauthorized Actor, given that spatial data is considered private user information in modern web standards. In terms of adversary behavior mapping under MITRE ATT&CK for Enterprise and Mobile, this flaw facilitates the Data from Information Repositories or potentially Device Control exploitation paths depending on how the exfiltrated WebXR data is utilized by the attacker to build profiles or conduct physical reconnaissance against victims. The attack vector falls under Attack Vector Network with a requirement of User Interaction, emphasizing that defense-in-depth strategies must include both technical controls and user awareness training regarding suspicious web content requesting immersive reality permissions.
Mitigation for this vulnerability primarily involves updating Google Chrome to version 152.0.7977.65 or later where the authorization checks have been corrected to strictly enforce origin boundaries when handling WebXR requests. Administrators should ensure that automatic update mechanisms are enabled across all endpoints to prevent exposure during the window of vulnerability. For organizations deploying immersive web applications, it is advisable to review and tighten Content Security Policy directives to restrict access to experimental or high-privilege APIs unless absolutely necessary. Additionally, security awareness programs should educate users on recognizing legitimate permission prompts for WebXR features, as these are relatively new capabilities that many users may not fully understand the implications of granting. By combining timely patching with robust policy enforcement and user education, organizations can effectively neutralize the risk posed by this authorization bypass in extended reality web contexts.