The vulnerability allows a remote attacker to collect sensitive information originating from the Omnibox in Google Chrome on Android. It is based on information exposure (CWE-200). The attacker can trigger the leak by sending specially crafted network traffic, thereby exposing private search queries or user input and potentially compromising confidentiality and privacy.

Google Chrome on Android, versions earlier than 155.0.8059.39, i.e., any release prior to that revision, are potentially affected.

The CVSS score indicates a medium severity (score 6.5). An EPSS score of 0.002 (less than 1%) indicates a very low but non‑zero exploitation probability, so the risk of exploitation may be uncommonly low. The vulnerability is not listed in the CISA KEV catalog, but it is remotely exploitable via crafted network traffic and can lead to information disclosure. The likely attack vector is a remote attacker leveraging crafted network traffic, which is inferred from the description that the attacker may need to employ social engineering to get the end user to load the malicious traffic. An attacker would also need to deliver the crafted traffic, for example by compromising a server or using a malicious Wi‑Fi network, to exploit the flaw.