The client's key share is the 1,184-byte ML-KEM-768 encapsulation key followed by a 32-byte X25519 public key (1,216 bytes); the server answers with the 1,088-byte ML-KEM ciphertext plus its 32-byte X25519 key (1,120 bytes). The shared secret is the 32-byte ML-KEM secret followed by the 32-byte X25519 secret. Unusually, the post-quantum part comes first here, while in SecP256r1MLKEM768 and SecP384r1MLKEM1024 the ECDH part comes first.
It replaced the pre-standard X25519Kyber768Draft00 (0x6399), which used round-3 Kyber and does not interoperate. Default support: Chrome and Edge 131 (November 2024), Firefox 132, Safari and the Apple platforms from iOS and macOS 26 (2025), OpenSSL 3.5, Go 1.24, and Cloudflare and other large CDNs on the server side. IANA marks it Recommended.
Costs are small but visible: the larger key share pushes a ClientHello beyond one typical network packet, which exposed middleboxes that mishandle fragmented handshakes, and one OpenSSL 3.6.5 key exchange takes three operations (keygen, encapsulation, decapsulation) at about 19,000–24,000 per second on one Apple M4 Max core. The browser PQ check shows whether your connection uses it.