This vulnerability arises from insufficient policy enforcement in the WebXR API of Google Chrome on Android, enabling a remote attacker to craft an HTML page that causes the browser to expose data from other origins. The result is a cross‑origin data leak, allowing the attacker to read information that should be protected by the same‑origin policy. The bug falls under the category of information exposure due to improper authorization controls within the WebXR component.

Affected browsers are Google Chrome versions prior to 150.0.7871.47 on Android devices. Any Android installation running a Chrome build before this release is susceptible when a user visits a malicious web page that leverages the compromised WebXR interface.

The CVSS score is not provided, but Chromium rates the issue as medium severity, indicating a moderate risk when the vulnerability is exploited. The EPSS metric is missing, so the exact probability of exploitation cannot be quantified, and the vulnerability is not listed by CISA as a known exploited vulnerability. The most likely attack vector is a modern web‑browser visit to a crafted HTML page; the attacker does not need elevated privileges and relies only on the victim’s Chrome instance.