This vulnerability involves side-channel information leakage in the WebXR feature of Google Chrome. An attacker can exploit this by crafting a malicious HTML page that, when visited by a user, could leak sensitive information from the browser's process memory. The vulnerability affects Chrome versions prior to 151.0.7922.72. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vendor has published an advisory indicating a stable channel update that presumably addresses this issue.

The vulnerability allows remote attackers to obtain potentially sensitive information from the process memory of affected Chrome browsers. This could lead to confidentiality breaches but does not affect integrity or availability. No known active exploitation has been reported.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later to remediate this vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides details on the update. No temporary workarounds or mitigations are indicated. Patch status is not explicitly confirmed in the advisory text provided, but the presence of a stable channel update strongly suggests an official fix is available.