A crafted HTML page can trigger an integer overflow in WebXR, which leads to a use‑after‑free condition that allows a remote attacker to run arbitrary code inside the sandbox environment of Google Chrome. This flaw bypasses the browser’s security boundaries and can compromise the confidentiality, integrity, and availability of systems using the affected browser. The severity reflected in the CVSS score of 8.8 indicates high potential damage.

Google Chrome versions prior to 151.0.7922.72 on all operating systems are affected. Users of these releases should check their browser version and upgrade to the latest stable channel to receive the mitigation.

The CVSS score of 8.8 marks this issue as high risk, while an EPSS score of less than 1% suggests that exploitation attempts are currently rare. The flaw is not listed in the CISA KEV catalog, indicating no known widespread use in the wild. The attack vector is inferred to be delivery of a malicious web page that the user must load, as the vulnerability is triggered by a crafted HTML payload processed by WebXR.