A use‑after‑free flaw in Chrome’s WebXR API allows a malicious crafted web page to trigger undefined memory access, leading to execution of arbitrary code outside the browser sandbox. This bypasses standard sandbox restrictions, enabling a remote attacker to run code with the privileges of the user on the affected machine.

The issue affects all desktop users of Google Chrome who are running a Chrome version lower than 157.0.8103.38. No specific patch release is listed in the advisory, but the Chrome release notes recommend updating to version 157.0.8103.38 or later to eliminate the vulnerability. The flaw is present in all platforms supported by Chrome that expose WebXR before this version.

The vulnerability has been rated high in Chromium’s internal severity scale. EPSS data is not available, and it is not yet listed in the CISA KEV catalog, so the exact exploitation probability is uncertain. Based on the description, the likely attack vector involves social engineering whereby a user is persuaded to load a malicious HTML page, after which the use‑after‑free is triggered and arbitrary code runs with the user’s privileges. There are no obvious preconditions other than running the affected browser version and visiting a crafted page, making it potentially widely exploitable if users can be tricked into loading such content.