CVE-2026-17869 is an out of bounds read vulnerability in the WebXR implementation of Google Chrome before version 151.0.7922.72. A remote attacker can exploit this by delivering a specially crafted HTML page that triggers an out of bounds memory read, potentially exposing sensitive information and causing denial of service. The CVSS v3.1 score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. The vulnerability was publicly disclosed on July 30, 2026. The vendor advisory linked indicates the fixed version is 151.0.7922.72.

Successful exploitation can lead to unauthorized disclosure of information due to out of bounds memory reads and can cause denial of service conditions. There is no indication of integrity compromise. The vulnerability requires user interaction but no privileges and can be triggered remotely over the network.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability is fixed. The vendor advisory confirms this version as the patched release. No additional mitigations are specified by the vendor.