An out of bounds read vulnerability in Google Chrome WebXR allows remote attackers to access sensitive memory through specially crafted HTML content.

This vulnerability is an out of bounds read (CWE-125) occurring within the WebXR component of the browser. It allows an unauthenticated remote attacker to trigger memory reads by enticing a user to visit a malicious HTML page.

The exploitation of this flaw could lead to the unauthorized disclosure of sensitive information stored in memory or contribute to a broader attack chain resulting in system instability. While the CVSS score of 8.1 reflects a high severity rating, the requirement for user interaction slightly mitigates the immediate risk of automated, widespread exploitation. Organizations relying on Chrome for sensitive browser-based workflows face potential data compromise if users are successfully phished or directed to malicious content.

Immediate Action: Update all Google Chrome installations to version 151.0.7922.72 or later immediately to incorporate the vendor-supplied fix.

Proactive Monitoring: Monitor endpoint security logs for unusual browser activity or crashes associated with WebXR processes, which may indicate attempted exploitation.

Compensating Controls: Deploy browser isolation solutions or endpoint security software capable of detecting and blocking navigation to malicious or untrusted domains that may host such exploits.

Public Exploit Available: No

Given the high CVSS score, organizations should prioritize the deployment of the latest Chrome update across all managed workstations. Ensuring that browsers are patched is the most effective defense against this out of bounds memory read, as it removes the underlying code vulnerability that enables the attack.