Description
Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper implementation in the WebXR component of Google Chrome allows a remote attacker to serve a crafted HTML page that can spoof user interface elements. The flaw corresponds to CWE-451.

Affected Systems

Google Chrome versions earlier than 150.0.7871.47 are vulnerable. No other browsers are mentioned as affected.

Risk and Exploitability

Chromium labels the issue as Low severity, with a CVSS score of 4.3 and an EPSS score of less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a malicious WebXR-enabled web page served to a user, requiring no local privilege or additional software.

Generated by OpenCVE AI on July 31, 2026 at 15:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Google Chrome 150.0.7871.47 or later.
  • If possible, disable WebXR for untrusted sites in Chrome’s site-settings or via the enterprise policy editor.
  • In environments where policy control is available, enforce a site configuration that disables WebXR APIs for all origins except those explicitly trusted.

Generated by OpenCVE AI on July 31, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Fri, 31 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Google Chrome

Sat, 25 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Google Chrome

Wed, 22 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Chrome WebXR UI Spoofing via Crafted HTML Page

Fri, 17 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title Chrome WebXR UI Spoofing via Crafted HTML Page

Wed, 15 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted WebXR Page in Google Chrome

Tue, 14 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted WebXR Page in Google Chrome

Sun, 12 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via crafted WebXR page in Google Chrome

Sat, 11 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via crafted WebXR page in Google Chrome

Fri, 10 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing via Inadequate Implementation in Google Chrome

Thu, 09 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing via Inadequate Implementation in Google Chrome

Wed, 08 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Chrome

Wed, 08 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Chrome

Tue, 07 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title WebXR Implementation Allows Remote UI Spoofing in Chrome

Mon, 06 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title WebXR Implementation Allows Remote UI Spoofing in Chrome

Sun, 05 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing in Google Chrome

Sun, 05 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing in Google Chrome

Sat, 04 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing via Crafted HTML Page in Chrome

Fri, 03 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title WebXR UI Spoofing via Crafted HTML Page in Chrome

Fri, 03 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted WebXR Page in Google Chrome

Thu, 02 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Crafted WebXR Page in Google Chrome

Thu, 02 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Google Chrome

Thu, 02 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via WebXR in Google Chrome

Wed, 01 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Chrome WebXR UI Spoofing Vulnerability
Weaknesses CWE-79

Wed, 01 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Chrome WebXR UI Spoofing Vulnerability
Weaknesses CWE-79

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Malicious WebXR Page in Google Chrome
Weaknesses CWE-853

Wed, 01 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Malicious WebXR Page in Google Chrome
Weaknesses CWE-853

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T14:54:57.024Z

Reserved: 2026-06-29T23:11:48.455Z

Link: CVE-2026-14132

cve-icon Vulnrichment

Updated: 2026-07-01T14:54:49.986Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T16:00:06Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information