Executive brief
Google Chrome, a widely used web browser, contains a vulnerability in its WebXR component, which is used for virtual and augmented reality experiences on the web. A remote attacker could exploit this flaw by tricking a user into visiting a specially crafted website. If successful, the attacker could execute unauthorized code within the browser's security sandbox, potentially leading to further compromise of the user's system or data.
Technical details
An integer overflow vulnerability exists in the WebXR component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to achieve arbitrary code execution within the renderer process sandbox. While the NVD record mentions an integer overflow, it also references CWE-416 (Use After Free), suggesting the overflow may lead to a memory corruption state. The vulnerability is addressed in Chrome version 151.0.7922.72 for Windows and Mac, and 151.0.7922.71 for Linux. Exploitation requires the victim to navigate to a malicious URL.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date