A crafted web page can trigger the WebXR subsystem in Google Chrome to read memory that has not been initialized, exposing data from other origins such as authentication tokens, secure cookies, or user content. The vulnerability is categorized as CWE‑457 (Use of Uninitialized Variable) and CWE‑824 (Untrusted Input to Unsafe Function). The impact is confined to information disclosure; it does not enable code execution, privilege escalation, or denial of service.

Google Chrome running on desktop operating systems is affected. Versions prior to 151.0.7922.72 are vulnerable. The bug involves the WebXR API, so it may affect any site that can access that feature. (The requirement that the feature be explicitly enabled is inferred from the description because it is not stated directly in the CVE data.)

The CVSS base score of 4.3 indicates a medium severity assessment. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. A remote attacker can host a malicious HTML page that targets the WebXR API, prompting Chrome to read uninitialized memory and leak cross‑origin data. This does not provide code execution or privilege escalation, but the stolen information could be used for credential theft, session hijacking, or other attacks.