Insufficient policy enforcement in the WebXR API on Android Chrome before 148.0.7778.168 allows an attacker who has already compromised the renderer process to read sensitive data from the process memory by loading a crafted HTML page. The flaw bypasses the sandbox policy protecting rendering memory, exposing potentially confidential information such as tokens or session data. The weakness falls under CWE‑280 and CWE‑693.

Google Chrome for Android versions earlier than 148.0.7778.168 are affected. The vulnerability is documented for the stable channel and appears in releases prior to the highlighted version.

The CVSS score is 5.3, indicating medium severity. EPSS score < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to first compromise the renderer process; once that is achieved, the attacker can read arbitrary process memory via a crafted HTML page. The attack vector is remote but depends on renderer compromise.