Technical impact
Insufficient policy enforcement in the WebXR subsystem of Google Chrome before version 151.0.7922.72 permits a remote attacker to bypass the browser’s same‑origin policy. By delivering a specially crafted HTML page that triggers a WebXR request, the attacker can read or interact with documents or data that would normally be protected, enabling unauthorized disclosure of confidential information. The weakness is classified as CWE‑346, a failure to restrict a function to its appropriate context.
Affected Systems
Google Chrome browsers older than 151.0.7922.72 on desktop platforms are affected. The vulnerability applies to the standard Chrome product across Windows, macOS, and Linux distributions; no additional vendor or product variants are listed.
Risk and Exploitability
The CVSS score of 6.5 classifies the issue as Medium severity, and the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attack vector is remote and requires the victim to load a malicious web page containing an engineered WebXR request. No user authentication or elevated privileges are needed; the impact is confined to the victim’s browser session, primarily compromising confidentiality of web content.
Debian DLA
Debian DSA