Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare

Extended reality XR systems are increasingly used in healthcare applications ranging from surgical planning to remote rehabilitation and mental health support. However, the rich streams of sensor, biometric, behavioral, and environmental data that enable these applications also introduce...

Android XR Bulletin—August 2026Stay organized with collectionsSave and categorize content based on your preferences.

The XR Security Bulletin contains details of security vulnerabilities affecting the XR platform. The full XR update comprises the security patch level of 2026-08-05 or later from the August 2026 Android Security Bulletin in addition to all issues in this bulletin. We encourage all customers to...

EUVD-2026-50931

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

PT-2026-66115

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description A side-channel information leakage exists in WebXR, which allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted HTML page...

CVE-2026-13947

An uninitialized use flaw was found in the XR component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513280648...

EUVD-2026-40635

Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13947

Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-14008

A Use of Uninitialized Variable vulnerability exists in the WebXR component of the Chromium browser (specifically affecting Google Chrome on Android prior to version 150.0.7871.47 ). A remote attacker could exploit this flaw by using a crafted HTML page to obtain potentially sensitive information...

CVE-2026-13947

A vulnerability in the XR component of the Chromium browser (affecting Google Chrome and Microsoft Edge ) was caused by an uninitialized use flaw. A remote attacker who had compromised the renderer process could use a crafted HTML page to obtain potentially sensitive information from process memo...

CVE-2026-13947

Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13947

Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

Chromium: CVE-2026-9890 Use after free in XR

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-33137

Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-9890

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

DEBIAN-CVE-2026-9890

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-9890

A use after free vulnerability exists in the XR component of Google Chrome on Windows prior to version 148.0.7778.216 . The root cause is a resource management error allowing the reuse of resources after they were released. A remote attacker who has already compromised the renderer process could ...

CVE-2026-9890

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-9890

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-9118

An use after free flaw was found in the XR component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498702233...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.216 contained a resource management vulnerability, which stemmed from a reuse issue within WebXR. This vulnerability could allow remote attackers to execute arbitrary code within a sandbox throug...