# CVE-2026-8583: Google Chrome for Android insufficient policy enforcement in WebXR

Source: https://junglewise.ai/threats/cve-2026-8583-google-chrome-for-android-insufficient-policy-enforcement-in-webxr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-8583 · Severity: medium · CVSS 5.3 · Published 2026-05-14

A security flaw in Google Chrome for Android's WebXR component—used for virtual and augmented reality experiences—could allow an attacker to access sensitive information. By tricking a user into visiting a specially crafted website, an attacker who has already partially compromised the browser's internal processes could read data from the device's memory. This could lead to the exposure of private user data or browsing information.

Technologies: [Google Android](https://junglewise.ai/threats/technologies/android), [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-8583 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8583 being exploited in the wild.

**How severe is CVE-2026-8583?** Medium severity, with a CVSS score of 5.3, published 14 May 2026.

**Which products and versions are affected?** Google Chrome prior to 148.0.7778.168.

**Is there a fix for CVE-2026-8583?** A patch was published on 2026-05-12: Stable channel update released for desktop and Android versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8583 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8583?** Check whether you run Google Android or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the WebXR component of Google Chrome for Android due to insufficient policy enforcement. The flaw allows a remote attacker to read sensitive information from the browser's process memory. To exploit this, an attacker must first achieve a compromise of the renderer process (e.g., via a separate vulnerability) and then entice a user to visit a malicious HTML page. This chain allows the attacker to bypass memory isolation boundaries within the WebXR implementation. The issue is resolved in version 148.0.7778.168.

## Affected products

- Google Chrome for Android prior to 148.0.7778.168

## Timeline

- 2026-05-12: patched: Stable channel update released for desktop and Android versions.
- 2026-05-14: disclosed: NVD publication date.

## References

- [https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html](https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html)
- [https://issues.chromium.org/issues/497975477](https://issues.chromium.org/issues/497975477)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)