This vulnerability arises from insufficient validation of untrusted input in the WebXR feature of Google Chrome versions before 150.0.7871.47. An attacker who has already compromised the renderer process could exploit this flaw to conduct UI spoofing attacks by crafting malicious HTML content. This could mislead users by displaying deceptive user interface elements. The vulnerability is acknowledged by Google with a published advisory but lacks explicit details on remediation level or patch availability in the provided data.

The vulnerability enables UI spoofing, which can deceive users into interacting with fraudulent interface elements. This could potentially facilitate further attacks such as phishing or unauthorized actions if the attacker controls the renderer process. However, exploitation requires prior compromise of the renderer process, limiting the scope of direct exploitation from an external attacker. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply official updates from Google Chrome once available to address this vulnerability.