This vulnerability is an uninitialized use issue in the WebXR implementation of Google Chrome versions before 151.0.7922.72. It allows a remote attacker to leak cross-origin data by crafting a malicious HTML page. The CVSS 3.1 score is 4.3 (medium), reflecting a network attack vector with low complexity and no privileges required but requiring user interaction. The vulnerability affects confidentiality but not integrity or availability. No official remediation level or patch link is provided in the input data, and the vendor advisory URL is given but does not specify patch status in the provided content.

An attacker can remotely cause information disclosure of cross-origin data due to uninitialized use in WebXR. This compromises confidentiality but does not affect data integrity or system availability. The attack requires user interaction and can be executed over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until a fix is confirmed, users should exercise caution when visiting untrusted websites that may exploit WebXR features.