This vulnerability involves uninitialized use in the XR (Extended Reality) component of Google Chrome versions before 150.0.7871.47. An attacker with control over the renderer process could exploit this flaw to read potentially sensitive information from process memory via a specially crafted HTML page. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. The vendor advisory linked does not explicitly confirm the availability of a patch or remediation status.

The vulnerability allows an attacker who has already compromised the renderer process to obtain sensitive information from memory, impacting confidentiality. There is no impact on integrity or availability. No public exploits are known at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to version 150.0.7871.47 or later once available and avoid visiting untrusted or suspicious web content that could exploit the renderer process.