An uninitialized local variable in the XR subsystem of Google Chrome allows a remote attacker to read sensitive information from the renderer process memory. If an attacker can send a specially crafted HTML page to a compromised renderer, they can expose confidential data. The weakness corresponds to CWE‑457 and is classified as medium severity by Chromium.

Users running Google Chrome versions earlier than 150.0.7871.47 on desktop systems are affected. The vulnerability exists in the Chrome stable channel and any process that loads renderer code enabling XR features.

The CVSS score for this issue is 5.3, indicating medium severity. The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. While the risk remains medium in the context of a compromised renderer process, the low exploitation likelihood reduces overall threat. An attacker must first compromise the renderer context; once achieved, memory disclosure is trivial via the crafted page.