A confused deputy flaw in Chrome Android’s WebAPK architecture allows an attacker to bypass the browser’s same‑origin policy by delivering a crafted HTML page. The vulnerability, traced to version strings before 155.0.8059.39, requires a social‑engineering attack to lure a user into loading the malicious WebAPK or visiting the crafted page. The flaw is represented as CWE‑346 (Authorization Bypass Through User‑Controlled Key) and CWE‑441 (Reuse of an Identifier), indicating that privileged components are misusing authority and that insufficient credential separation enables the breach of web origin boundaries.

Users of Google Chrome on Android operating systems running Chrome versions earlier than 155.0.8059.39 and who have installed or enabled WebAPKs are affected. The update mechanism for Chrome on Android will deliver the fix automatically through the Chrome update channel.

The CVSS score of 8.3 classifies the issue as high severity, yet the EPSS score of less than 1% points to a very low probability of exploitation in the wild. The attack vector hinges on a crafted HTML page, so it is essentially a social‑engineering challenge. Although not listed in CISA’s KEV catalog, the vulnerability could allow a successful attacker to read or modify data that should be protected by the web origin policy, giving potential access to sensitive user information or a foothold for further compromise.