A flaw in Chromium’s WebXR implementation permits a remote attacker to craft a malicious HTML page that reads sensitive data from the browser’s process memory. The vulnerability can lead to disclosure of potentially confidential information, impacting confidentiality. The weakness is aligned with CWE‑200 (Information Exposure) and CWE‑497 (Improper Security Reviews).

Google Chrome users running any version prior to 151.0.7922.72 are affected. The issue was reported for the Chrome stable channel and applies to all desktop builds that incorporate the older WebXR code path.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that the exploitation rate is currently low. The vulnerability is not in the CISA KEV catalog. Exploitation requires a user to open a crafted web page in Chrome; no additional privilege escalation or local access is needed, making the attack vector likely remote via the browser.