CVE-2026-14008: Chrome Android WebXR Memory Disclosure Vulnerability

Technical summary

CVE-2026-14008 is an uninitialized use vulnerability (CWE-457) in WebXR, a Web API for immersive device interaction in Chrome on Android. The defect allows an attacker to access uninitialized memory buffers within the Chrome process through a specially crafted HTML document. Because WebXR state or intermediate processing buffers are not properly zeroed before use, attacker-controlled JavaScript can infer or extract memory contents that were never intended to be readable. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android platforms. The attack is network-based, requires no privilege, and depends on user interaction to trigger the malicious page load.

Business impact

Organizations supporting mobile workforces using Chrome on Android face a confidentiality risk. If employees browse attacker-controlled content (via phishing, compromised ads, or malicious websites), attackers could exfiltrate sensitive information from browser memory, including session tokens, API credentials, or cached personal data. While the vulnerability does not enable code execution or denial of service, the memory disclosure could facilitate downstream attacks such as account compromise or identity theft. For enterprise environments relying on web-based applications for sensitive workflows on mobile, this represents a meaningful insider-facing and external threat surface.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on Android are vulnerable. The defect is specific to Chrome's WebXR implementation and does not affect Chrome on desktop platforms or other browsers. Android devices running older Chrome builds without this patch are at risk. Users on Android who have not updated Chrome to version 150.0.7871.47 or later remain vulnerable.

Exploitability

Exploitability is relatively straightforward. An attacker needs only to host a crafted HTML page containing malicious WebXR JavaScript and socially engineer or trick users into visiting it. No zero-click attack is required—user interaction (visiting the page) is necessary—but this is a low barrier in practice given phishing, ad networks, or drive-by download tactics. The vulnerability does not require the user to grant unusual permissions or modify browser settings. Once the user's browser loads the page, memory disclosure occurs automatically. However, the vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities catalog, suggesting limited public active exploitation at the time of publication.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Verify the update has been applied through Chrome Settings > About Chrome, which will display the current version and automatically check for updates. For organizations managing Android devices via Mobile Device Management (MDM) or enterprise enrollment, enforce Chrome version constraints in device compliance policies to prevent use of vulnerable versions. Users should avoid visiting untrusted websites and remain cautious of links in email or messaging apps, as this attack depends on user navigation to the attacker's page.

Patch guidance

Google Chrome on Android will automatically prompt users to update when a new version is available. Users can manually check for updates by opening Chrome, navigating to Settings > About Chrome, and confirming the installed version is 150.0.7871.47 or later. Enterprise administrators deploying Chrome on managed Android devices should validate patch deployment through their MDM solution and confirm version compliance across the device fleet. There are no interim mitigations short of updating; disabling WebXR at the browser level is not a standard user-facing option in Chrome.

Detection guidance

Detection of exploitation is challenging because the attack leaves minimal forensic traces. Monitor for unusual network traffic from Chrome processes to external domains, particularly if combined with user-reported performance degradation or unusual battery drain (though these are non-specific). Endpoint Detection and Response (EDR) solutions on Android are limited; instead, rely on Chrome's automatic update telemetry and device compliance reporting to confirm patch status across the organization. Look for Chrome versions older than 150.0.7871.47 in device inventory scans. Behavioral monitoring for WebXR API abuse is not widely available in consumer or mainstream MDM tools.

Why prioritize this

Although this is a CVSS 6.5 Medium severity vulnerability, it merits timely attention for mobile-forward organizations. Memory disclosure vulnerabilities are often underestimated; they can expose credentials, API tokens, and session data that enable lateral movement or account takeover. The low barrier to exploitation (craft a page, socialize the link) combined with the confidentiality impact justifies priority patching within 2-4 weeks. Organizations with significant Android Chrome deployments—especially those handling sensitive customer or financial data—should prioritize this above cosmetic or low-impact fixes. The absence from the KEV catalog indicates limited current mass exploitation, reducing urgency relative to critical RCE flaws, but the vulnerability should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity attack requiring user interaction but resulting in high confidentiality impact with no integrity or availability impact. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N breaks down as: network-based attack, no special conditions, no privileges needed, user click required, confidentiality loss is high (memory contents exposed), and no system boundary crossing. The score does not account for the difficulty of weaponizing memory disclosures into actionable attacks, which is why real-world risk may vary based on what sensitive data is typically in Chrome's process memory for a given organization.

Frequently asked questions