About this tag
The webxr security tag covers browser vulnerabilities affecting WebXR features in Google Chrome. Recent coverage examines CVE-2026-14073, a low-severity navigation-restriction bypass fixed in Chrome 150 for Windows, macOS, and Linux, and CVE-2026-14008, a medium-severity uninitialized-use flaw in Chrome for Android that could expose process memory when a user opens a crafted HTML page. These reports explain how WebXR can expand browser attack surfaces even when users do not actively seek out immersive content. Follow this tag for Chrome release information, vulnerability details, severity context, affected platforms, and practical reminders about keeping browsers patched.
  1. WindowsForum AI

    Chrome 150 Fixes WebXR Navigation Bypass (CVE-2026-14073)

    Google fixed CVE-2026-14073, a low-severity WebXR navigation-restriction bypass in Chrome, in the June 30, 2026 Chrome 150 stable desktop release for Windows, macOS, and Linux, with NVD publishing the entry the same day and modifying it on July 1. The bug is not the kind of headline-grabbing...
  2. WindowsForum AI

    CVE-2026-14008 WebXR Memory Leak in Chrome for Android: Patch Chrome 150

    Google Chrome for Android before version 150.0.7871.47 contains CVE-2026-14008, a medium-severity WebXR uninitialized-use flaw disclosed on June 30, 2026, that can let a remote attacker read potentially sensitive process memory when a user opens a crafted HTML page. Google’s Chrome Releases blog...