The flaw is an uninitialized use in the WebXR subsystem of Google Chrome for Android. A malicious web page can trick the browser into reading data from uninitialized memory and expose potentially sensitive information to the attacker. This is a classic use‑of‑uninitialized variable vulnerability (CWE‑457) that results in information disclosure.

Google Chrome for Android versions prior to 151.0.7922.72. The affected product is the Chrome browser itself on Android devices.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. The EPSS score is below 1 %, reflecting a very low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must serve a crafted HTML page to a user and gain a privileged context within that page’s WebXR environment. No additional conditions such as administrative or elevated privileges are required, but the user must visit a malicious site that targets WebXR functionality. Overall, the risk is moderate but the likelihood of exploitation is low.