CVE-2026-14008

MediumCVSS 6.5

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile — higher than 15% of all known CVEs

Summary

Uninitialized use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Risk Assessment

An attacker could leak confidential data from browser memory, such as passwords, session tokens, or other user data, posing a medium risk to the organization.

Recommendation

Immediately update Google Chrome on Android to version 150.0.7871.47 or later to remediate the vulnerability.

Original NVD description (English source)

Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)