CVE-2026-17869 is an out of bounds read vulnerability in the WebXR implementation of Google Chrome before version 151.0.7922.72. A remote attacker can exploit this by delivering a specially crafted HTML page that triggers an out of bounds memory read, potentially exposing sensitive memory contents. The vulnerability is categorized under CWE-125 (Out-of-bounds Read). No CVSS score is available, but Chromium's internal assessment rates it as Medium severity.

Successful exploitation allows a remote attacker to read memory outside the intended bounds within the WebXR component of the browser. This could lead to information disclosure of sensitive data residing in memory. There is no indication of code execution or other impacts. No known exploits are reported in the wild.

A fix is available in Google Chrome version 151.0.7922.72 and later. Users and administrators should update to this version or a more recent release to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the browser update. Patch status is confirmed by the version boundary stated in the description.