CVE-2026-17892 describes an inappropriate implementation in the WebXR component of Google Chrome versions before 151.0.7922.72. This flaw enables a remote attacker to extract potentially sensitive information from process memory by delivering a specially crafted HTML page. The vulnerability has a medium severity rating and a CVSS 3.1 base score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, user interaction needed, and high confidentiality impact without affecting integrity or availability. The vulnerability is publicly disclosed and documented by Google, but no official remediation level or patch link is explicitly stated in the input data. The vendor advisory URL is provided for further details.

An attacker can remotely cause information disclosure of sensitive data from the browser's process memory by tricking a user into visiting a maliciously crafted webpage. This could lead to exposure of confidential information but does not affect system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update to Chrome version 151.0.7922.72 or later once available to mitigate this vulnerability.