If you are using an up to date version of Firefox, Edge or Chrome it defaults to Lax. The exceptions are Safari, IE and Safari for IOS. I don't think this is worth a 8.1 CVSS.

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...