CVE-2026-17889 is an uninitialized use vulnerability in the WebXR implementation of Google Chrome that enables remote attackers to leak cross-origin data by crafting a malicious HTML page. The vulnerability affects versions of Chrome prior to 151.0.7922.72. The Chromium security team has rated this vulnerability as medium severity. Although a vendor advisory link is provided, it does not explicitly state the availability of a patch or remediation level. No CVSS score is assigned to this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to leak data across origins, potentially exposing sensitive information from other web domains to the attacker. The impact is limited to information disclosure rather than code execution or system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should update Google Chrome to version 151.0.7922.72 or later once confirmed patched. Until then, no specific mitigation beyond updating is available from the provided data.