An insecure implementation in the WebXR API of Google Chrome allows a remote attacker to elevate a crafted HTML page into a vector that reads sensitive data from the browser process memory, enabling disclosure of information that should remain confidential. The flaw is a classic case of information exposure (CWE‑200) and memory leakage (CWE‑825). The impact is limited to memory that belongs to the browsing context, but can still yield valuable data for further attacks.

The vulnerability exists in Google Chrome versions prior to 151.0.7922.72, affecting any user that installs a build older than this release. No other vendors or product lines are specifically mentioned.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of being actively exploited. The flaw is not catalogued in CISA’s KEV list, reflecting limited known exploitation. The attack vector is a remote crafted web page that a malicious site can serve to any user who visits it. To exploit the flaw, an attacker must host a malicious page; no elevated privileges beyond normal browser access are required. The resulting information disclosure could aid later attacks.