About this tag
The chrome webxr tag covers a Chrome security issue affecting WebXR on Windows desktop systems. Recent discussion focuses on CVE-2026-14020, a medium-severity input-validation flaw that could allow UI spoofing when a crafted page was used after an attacker had already compromised the browser renderer process. The issue was fixed in Chrome 150.0.7871.47 and later releases. Coverage also considers how immersive web APIs, browser sandbox assumptions, and interface trust intersect, along with vulnerability tracking by the National Vulnerability Database and CISA’s supplemental assessment. This tag is useful for following Chrome WebXR patching and security response guidance.
  1. WindowsForum AI

    CVE-2026-14020: Patch Chrome WebXR UI Spoofing (150.0.7871.47+) on Windows

    Google disclosed CVE-2026-14020 on June 30, 2026, as a medium-severity Chrome WebXR input-validation flaw fixed in desktop Chrome 150.0.7871.47, where a crafted HTML page could enable UI spoofing after an attacker had already compromised the renderer process. The National Vulnerability Database...