This vulnerability concerns insufficient policy enforcement in the WebXR implementation of Google Chrome on Android versions before 148.0.7778.168. An attacker with control over the renderer process can leverage a crafted HTML page to extract potentially sensitive information from process memory. The issue is specific to the WebXR feature and requires prior compromise of the renderer process. The vulnerability was publicly disclosed on May 14, 2026. The vendor advisory linked does not explicitly confirm patch availability or remediation details for this specific CVE. No CVSS score is assigned.

If exploited, an attacker who has already compromised the renderer process in Chrome on Android could gain access to sensitive information from process memory via crafted web content. This could lead to information disclosure but does not indicate direct remote code execution or broader system compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update announcement does not explicitly confirm a fix for this vulnerability. Users should update to Chrome version 148.0.7778.168 or later once confirmed by the vendor. Until then, no specific mitigation beyond updating can be recommended.