Insufficient validation of untrusted input in Chrome’s WebXR API allows an attacker who has compromised the renderer process to supply a crafted HTML page that causes UI spoofing. Based on the description, it is inferred that the attacker can mislead users into interacting with deceptive content, potentially facilitating social‑engineering attacks.

Google Chrome browsers running the stable channel on desktop platforms with a version earlier than 150.0.7871. The desktop usage is inferred from the context of the stable channel release notes and the absence of any mention of mobile devices in the advisory.

Exploitation requires an attacker to first compromise or inject code into Chrome’s renderer process, a highly privileged component. The CVSS score of 4.3 combined with an EPSS score of less than 1 % indicates moderate severity but a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently widely exploited. Based on the description, the likely attack vector involves a remote attacker who has compromised the renderer process and supplies a crafted HTML page leveraging WebXR to perform UI spoofing.