CVE-2026-6358

Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-6358

Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-6358

Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-6358

The CVE describes a Use-After-Free in XR for Google Chrome on Android, before version 147.0.7727.101, allowing a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected product: Google Chrome for Android (XR component). Cause: use-after-free in the XR path leads ...

XREAL Nebula App 安全漏洞

The XREAL Nebula App is an application designed for XREAL’s augmented reality devices. Versions of the XREAL Nebula App 3.2.1 and earlier contained security vulnerabilities. These vulnerabilities stemmed from improper handling of parameters such as accessKey, secretAccessKey, and securityToken in...

[SECURITY] Fedora 42 Update: envision-3.2.0-7.fc42

UI for building, configuring, and running Monado, the open source OpenXR runtime. This is still highly experimental software, while it's unlikely that anything bad will happen, it's still unstable and there is no guarantee that it will work on your system, with your particular hardware. If you...

Industrialized Ransomware: Confronting the New Reality

Read about the new ransomware reality and what most security strategies get wrong. Learn how to protect your organization in 2026...

UEVR security vulnerabilities

UEVR is a general-purpose VR engine module developed by PrayDog’s individual developer. Versions of UEVR prior to 1.05 contained security vulnerabilities, which were caused by an out-of-bound read operation in the program file lparser.C...

CVE-2023-29780

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

CVE-2021-31882

A vulnerability has been identified in Capital Embedded AR Classic 431-422 All versions, Capital Embedded AR Classic R20-11 All versions V2303. The DHCP client application does not validate the length of the Domain Name Server IP options 0x06 when processing DHCP ACK packets. This may lead to...

Android XR Bulletin—January 2026Stay organized with collectionsSave and categorize content based on your preferences.

The XR Security Bulletin contains details of security vulnerabilities affecting the XR platform. The full XR update comprises the security patch level of 2026-01-05 or later from the January 2026 Android Security Bulletin in addition to all issues in this bulletin. We encourage all customers to...

WebXR Flaw Hits 4 Billion Chromium Users, Update Your Browser Now

Cybersecurity startup AISLE discovered a Medium severity flaw in the WebXR component of Chrome, Edge, and other Chromium browsers. Over 4 billion devices were at risk. Update now...

EUVD-2025-176929

Malicious code in publish-antimatter-augmentedreality-hawkingradiation npm...

EUVD-2025-178892

Malicious code in firebase-helios-bionics-virtualreality npm...

EUVD-2025-175601

Malicious code in webdriver-mocha-scripts-hadron-augmentedreality npm...

EUVD-2025-180245

Malicious code in augmentedreality-frontend-cz-conventional-changelog-neptunology npm...

EUVD-2025-177732

Malicious code in mutation-augmentedreality-archaeoastronomy-neutronstar npm...

EUVD-2025-180242

Malicious code in augmentedreality-vega-chai-cosmogenic npm...

EUVD-2025-179334

Malicious code in deneb-juno-virtualreality-middleware npm...

EUVD-2025-179812

Malicious code in ceres-augmentedreality-iota-transport npm...