CVE-2026-18005 is an information disclosure vulnerability in the WebXR component of Google Chrome versions before 151.0.7922.72. The flaw allows a remote attacker to craft a malicious HTML page that can extract potentially sensitive information from the browser's process memory. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. There is no indication of integrity or availability impact. The vendor advisory linked does not explicitly state patch availability or remediation details.

An attacker who successfully exploits this vulnerability can obtain sensitive information from the process memory of the affected Chrome browser. This could lead to leakage of confidential data. There are no known exploits in the wild, and the impact is limited to information disclosure without integrity or availability compromise.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update to Chrome version 151.0.7922.72 or later once confirmed. Until then, exercising caution with untrusted web content is advisable.