A crafted HTML page can exploit a side‑channel information leakage in the WebXR implementation of Google Chrome. The flaw allows a remote attacker to read potentially sensitive data from the process memory of the affected browser. This vulnerability primarily results in confidentiality compromise, with no direct impact on integrity or availability.

Google Chrome browsers running any version before 151.0.7922.72 are vulnerable. The defect exists on all platforms where the WebXR feature is enabled, affecting users who access WebXR‑enabled web content.

The CVSS score of 6.5 categorizes this issue as medium severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious web page that a user opens or visits, which then leverages the WebXR API to access memory contents. Because the vulnerability relies on a crafted page, successful exploitation requires user interaction with the malicious content, but once the page is loaded, the attacker can read memory fragments exposed through the side channel.