This vulnerability is an integer overflow in the WebXR implementation of Google Chrome before version 151.0.7922.72. The flaw leads to a use-after-free condition that can be triggered remotely via a crafted HTML page, enabling arbitrary code execution inside the sandboxed environment of the browser. The CVSS 3.1 vector indicates the attack requires no privileges and low attack complexity but requires user interaction. The impact includes high confidentiality, integrity, and availability consequences. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation level.

Successful exploitation allows remote attackers to execute arbitrary code inside the Chrome sandbox, potentially compromising browser security and user data confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 8.8, reflecting significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until a patch is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious WebXR content.