Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak… (CVE-2026-78962)

CVE-2026-78962 is an uninitialized resource vulnerability in the WebXR implementation of Google Chrome before version 152.0.7977.65. This flaw allows a remote attacker, through social engineering, to potentially leak cross-origin data by hosting a specially crafted HTML page that exploits the uninitialized resource. The vulnerability is classified under CWE-908 and has a CVSS 3.1 base score of 4.3, indicating a medium severity. No known exploits are reported in the wild, and the vulnerability requires user interaction to be triggered.

The vulnerability could lead to unauthorized disclosure of cross-origin data when a user interacts with a maliciously crafted webpage. There is no impact on integrity or availability, and exploitation requires user interaction, limiting the severity to medium.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated.