This vulnerability in Google Chrome's WebXR feature involves insufficient policy enforcement due to inadequate validation of untrusted input. An attacker can exploit this flaw by crafting a malicious HTML page that bypasses navigation restrictions. The issue affects Chrome versions before 150.0.7871.47. The CVSS 3.1 base score is 4.3, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, user interaction needed, and impact limited to integrity loss without confidentiality or availability impact. The vulnerability is publicly disclosed but no official remediation level or patch availability is explicitly stated in the provided data. The vendor advisory link is provided but does not explicitly confirm patch status in the input.

The vulnerability allows a remote attacker to bypass navigation restrictions in the WebXR component of Google Chrome, potentially leading to unauthorized navigation actions. The impact is limited to integrity loss without affecting confidentiality or availability. There are no known exploits in the wild, and the severity is rated medium.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Since no explicit patch or remediation level is provided in the input data, users and administrators should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed. No additional mitigation steps are specified.