A use-after-free vulnerability in the XR component of Google Chrome on Android allows a remote attacker to trigger an out-of-bounds memory read through a crafted HTML page. This flaw is classified as CWE‑416 and CWE‑125 and is considered critical in Chromium's security rating, suggesting that a successful exploitation could compromise data confidentiality and potentially enable further malicious actions in the browser session.

Google Chrome for Android users running versions prior to 147.0.7727.101 are impacted. The vulnerability is confined to the XR component and does not affect non-Android distributions or newer Chrome versions that have addressed the issue.

The CVSS score of 8.8 indicates high severity. Because the flaw can be triggered by a simple web page, the attack surface is wide from any network the device connects to. Even without publicly disclosed exploits, the critical nature of the vulnerability, as rated by Chromium, demands immediate remediation. Attackers can read arbitrary memory, which may be leveraged for credential theft or as a foothold for further exploitation. Prompt patching is essential.