Use-after-free in XR in Google Chrome on Android

Successful exploitation allows a remote attacker to cause an out-of-bounds memory read within the browser process space associated with the XR component. This can result in disclosure of sensitive memory contents. The provided content also indicates high confidentiality, integrity, and availability impact in the assigned CVSS vector, and notes that while public documentation specifically describes memory disclosure, further exploitation beyond information disclosure, potentially including more serious compromise, may be possible; however, no public exploitation chain is documented in the provided material.

If immediate patching is not possible, reduce exposure by limiting use of vulnerable Chrome versions on Android, prioritizing updates for unmanaged or internet-exposed user populations, and restricting access to untrusted web content where operationally feasible. The provided content does not describe a vendor workaround, and version-based identification and rapid patching are the primary defensive measures.

Update Google Chrome on Android to version 147.0.7727.101 or later. The provided content identifies 147.0.7727.101 as the minimum safe version for Android. Organizations should audit managed Android device inventories and enforce minimum Chrome versions through MDM or enterprise browser management where applicable.