An incorrect authorization check in the WebView component of Google Chrome on Android permits a compromised renderer process to craft a malicious HTML page that can be used to execute arbitrary code beyond the intended sandbox boundaries. The vulnerability is a classic example of insufficient privilege separation, allowing an attacker to gain higher privilege access than intended in the browser’s rendering engine. The potential consequence is the compromise of the host device, disclosure of sensitive data, and further spread of malware.

All Android devices running Google Chrome before version 154.0.8037.92 are affected. The flaw resides in the browser’s WebView implementation, which is part of the core Chrome application on these devices. Stricter version controls apply: users of Android OS with older Chrome installations must check for updates to the specified affected build number.

The CVSS score of 7.5 indicates a high impact vulnerability, though the exploit probability is not listed in EPSS. The flaw is not currently catalogued by CISA as a known exploited vulnerability, but the existence of a path to arbitrary code execution outside the sandbox elevates the risk if an attacker manages to compromise the renderer process. Attackers would need to first exploit another flaw or gain access to the renderer in order to supply the crafted HTML payload, making this scenario more complex but not infeasible in a compromised device or in the presence of additional weaknesses.