A flaw in the way Google Chrome for Android authorizes PDF content allows a local attacker, using social engineering, to gain access to sensitive information that would normally be protected by the document’s access controls. This incorrect access control is classified as CWE-863 and involves bypassing legitimate restrictions imposed on PDF files.

Google Chrome for Android versions older than 155.0.8059.39 are affected. The issue specifically impacts devices running the browser on Android where PDF files are opened or rendered by the browser. Newer releases, starting with 155.0.8059.39, contain a fix that implements proper authorization checks before exposing PDF data.

Exploitation requires local device access and the attacker must convince a user to install a malicious or co‑installed application capable of reading PDF data. No public exploit code is known and the EPSS score is unavailable. The CVSS score of 5.9 indicates a medium severity level. The vulnerability is not in the CISA KEV catalog, and because it depends on local presence and user interaction, its likelihood of widespread exploitation is limited, but individual users remain at risk.