This vulnerability in Google Chrome's WebXR component allows a remote attacker to bypass the same origin policy due to insufficient policy enforcement. The flaw exists in versions prior to 151.0.7922.72 and can be triggered by a crafted HTML page. The issue is tracked as CWE-346 (Insufficient Authorization) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. The vulnerability does not impact confidentiality but can affect data integrity. There is no explicit vendor advisory stating a patch or fix status, but the affected versions are prior to 151.0.7922.72, implying that this version includes the fix.

The vulnerability allows remote attackers to bypass the same origin policy in WebXR, potentially enabling unauthorized actions or data manipulation within the browser context. The impact is limited to integrity (I:H) with no confidentiality (C:N) or availability (A:N) impact. This could lead to unauthorized modification of data or behavior within the affected browser session.

Google Chrome version 151.0.7922.72 addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. There is no indication of known exploits in the wild. No additional mitigation steps are specified by the vendor advisory.