CVE-2026-17869 Google CVE debrief

Who should care

IT administrators and security teams responsible for managing Google Chrome installations, as well as developers using WebXR in their applications, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

CVE-2026-17869 is an out-of-bounds read vulnerability in the WebXR feature of Google Chrome versions prior to 151.0.7922.72. This vulnerability allows remote attackers to perform out-of-bounds memory reads via crafted HTML pages. The issue has a CVSS score of 8.1 and is classified as High severity. Chromium rates this vulnerability as Medium severity. The vulnerability affects Google Chrome installations and can be mitigated by applying the official patch, upgrading to version 151.0.7922.72 or later, and implementing compensating controls. The CVE record was published on 2026-07-30T01:16:50.817Z and has not been modified since then. Official sources, including the NVD and CVE.org, confirm this vulnerability. The vulnerability can be addressed by IT administrators and security teams responsible for managing Google Chrome installations, as well as developers using WebXR in their applications. To prevent potential memory reads, it is crucial to take necessary actions to mitigate the risk associated with this vulnerability. The official patch should be applied, and Google Chrome installations should be inventoried and monitored to ensure they are up-to-date. Compensating controls, such as network monitoring, should also be implemented to detect potential exploitation attempts. The Chromium issue tracker entry for CVE-2026-17869 provides technical details about the vulnerability, and the Google Chrome release blog post detailing the stable channel update for desktop includes the fix for CVE-2026-17869. The NVD provides detailed information on CVE-2026-17869, including its CVSS score and current status. The CVE.org provides the official CVE record for CVE-2026-17869, confirming the vulnerability details. The source item URL provides additional context and details about the vulnerability from the NVD. The vulnerability is considered a Medium severity vulnerability by Chromium, requiring immediate attention to prevent potential memory reads. The defensive priority for this vulnerability is Medium severity, and it is essential to review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The affected product deployments

Defensive priority

Medium severity vulnerability in Google Chrome, requiring immediate attention to prevent potential memory reads.

Recommended defensive actions

• Apply the official patch: Upgrade Google Chrome to version 151.0.7922.72 or later.
• Inventory and monitor Google Chrome installations to ensure they are up-to-date.
• Implement compensating controls, such as network monitoring, to detect potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-17869 record indicates an out-of-bounds read vulnerability in WebXR of Google Chrome prior to version 151.0.7922.72. This issue, with a CVSS score of 8.1, could allow remote attackers to perform out-of-bounds memory reads via crafted HTML pages. The vulnerability is classified as Medium severity by Chromium. Official sources, including the NVD and CVE.org, confirm this vulnerability.

Official resources