Information leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (CVE-2026-79125)

CVE-2026-79125 is an information disclosure vulnerability in the XR subsystem of Google Chrome before version 152.0.7977.65. A remote attacker can exploit this flaw by delivering a specially crafted HTML page that leaks sensitive information to the attacker. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

Successful exploitation allows an attacker to obtain sensitive information from the affected user's browser environment. There is no impact on integrity or availability. The vulnerability requires user interaction, limiting the attack vector to scenarios where a user visits a malicious or compromised webpage.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.