Incorrect authorization checks in Chrome’s Autofill feature on Android allow a crafted HTML page to access sensitive stored data, resulting in the disclosure of confidential information. (The type of data exposed is inferred from the description, with it presumed to include payment details or personal contact information.)

Google Chrome for Android versions older than 155.0.8059.39 are affected. Only the Android browser channel is mentioned, with no reference to other operating systems or distribution channels.

The CVSS score of 8.8 indicates a high severity impact, yet the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is that a remote attacker hosts a malicious webpage that the user visits in Chrome. (Based on the description, it is inferred that the attacker must lure a user to open the crafted page, after which the information can be exfiltrated.) The risk of exploitation remains uncertain but is considered significant due to the high CVSS score.