Insufficient policy enforcement in the WebXR subsystem of Google Chrome before version 151.0.7922.72 permits a remote attacker to bypass the browser’s same‑origin policy. By delivering a specially crafted HTML page that triggers a WebXR request, the attacker can read or interact with documents or data that would normally be protected, enabling unauthorized disclosure of confidential information. The weakness is classified as CWE‑346, a failure to restrict a function to its appropriate context.

Google Chrome browsers older than 151.0.7922.72 on desktop platforms are affected. The vulnerability applies to the standard Chrome product across Windows, macOS, and Linux distributions; no additional vendor or product variants are listed.

The CVSS score of 6.5 classifies the issue as Medium severity, and the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attack vector is remote and requires the victim to load a malicious web page containing an engineered WebXR request. No user authentication or elevated privileges are needed; the impact is confined to the victim’s browser session, primarily compromising confidentiality of web content.