CVE-2026-13947: Chrome XR Uninitialized Memory Information Disclosure

Technical summary

This vulnerability stems from uninitialized memory usage (CWE-457) in Chrome's XR subsystem. When XR components fail to properly initialize memory structures before use, an attacker with renderer process compromise can craft HTML that triggers access to uninitialized buffers, leaking heap or stack data that may contain sensitive information from other processes or previous allocations. The issue exists prior to Chrome version 150.0.7871.47, where the XR code path was hardened to ensure all memory is initialized before use.

Business impact

Information disclosure from a compromised renderer process could expose authentication tokens, session cookies, cached credentials, or other sensitive data residing in Chrome's memory. While the attack chain requires prior renderer compromise, organizations with users visiting untrusted sites or those subject to supply-chain attacks face elevated risk. The impact is confidentiality-focused; data is leaked but not corrupted or deleted. This could facilitate follow-on attacks such as account takeover or privilege escalation if disclosed credentials are reused across systems.

Affected systems

Google Chrome prior to version 150.0.7871.47 on all platforms (Windows, macOS, Linux, Android, iOS) is affected. Organizations should identify users on Chrome versions below 150.0.7871.47 through mobile device management (MDM), endpoint detection and response (EDR) tools, or browser telemetry. Other Chromium-based browsers (Edge, Brave, Opera, etc.) should be checked if they track upstream Chromium patches; the vulnerability likely affects them at comparable version thresholds.

Exploitability

Exploitation is not trivial and requires a multi-stage attack. First, an attacker must compromise Chrome's renderer process through another vulnerability or attack vector. Second, the attacker must then craft a malicious HTML page that triggers the uninitialized XR memory access. User interaction is required. The CVSS score of 5.3 (Medium) reflects these preconditions. This is not an in-the-wild exploitation risk for users simply visiting random websites, but represents a meaningful concern for organizations where the renderer may already be under attacker control.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Use your organization's browser update policy or MDM solution to enforce rapid deployment. For users who cannot update immediately, disable XR features in Chrome settings (Settings > Advanced > Site Settings > Extended Reality Devices) to eliminate the attack surface, though this is a temporary workaround pending patching. Monitor for other renderer process vulnerabilities that could serve as the initial compromise vector.

Patch guidance

Chrome automatically prompts users to update when a new version is available, but enforcement may vary. Organizations should: (1) Enable automatic updates through Chrome managed policies, (2) Use MDM to push Chrome 150.0.7871.47 or later to all managed devices, (3) Verify patching within 48–72 hours using browser telemetry or endpoint reporting, (4) Prioritize patches for users in high-risk roles (finance, legal, DevOps) who may handle sensitive credentials. Verify the patch version against Google's official Chrome release notes to confirm you are deploying the correct build.

Detection guidance

Monitor for signs of renderer process compromise preceding this attack: unusual child process spawning from chrome.exe, unexpected network outbound connections from browser processes, or XR-related syscalls in unexpected contexts. Look for browser crash dumps or out-of-memory errors. EDR or behavioral analysis tools may flag memory access patterns consistent with heap spraying or uninitialized buffer reads. Correlate XR feature usage logs with any anomalies. Conduct memory forensics on suspected systems to identify leaked data.

Why prioritize this

This vulnerability merits immediate but measured attention. The CVSS score of 5.3 is Medium, and the attack requires renderer process compromise as a precondition, limiting the blast radius. However, organizations with high-risk users, those supporting XR development or testing, or those already concerned about renderer exploits should prioritize patching. The confidentiality-only impact (no integrity or availability loss) places it below critical severity, but information leakage can enable lateral movement or credential theft. Patch within 30 days as part of normal Chrome update cycles.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Attack Vector Network (potential to reach from the internet via a webpage), Access Complexity High (requires prior renderer compromise and user interaction), Privileges Required None (no special privileges needed once renderer is compromised), User Interaction Required (user must interact with malicious HTML), Scope Unchanged (impact is limited to the browser), Confidentiality High (sensitive memory data is leaked), Integrity None, Availability None. The Medium severity appropriately captures that this is a data leak threat that requires a precondition.

Frequently asked questions