The vulnerability arises from a missing authorization check in the mobile component of Google Chrome for Android, allowing a local attacker who has successfully deceived a user into installing a co‑installed application to run arbitrary code beyond Chrome’s sandbox. This flaw can lead to complete compromise of the device, including data theft, persistence, and further propagation of malware. The weakness is classified as CWE‑862, reflecting an information or access control flaw that permits privilege escalation within the app’s context.

Android devices running Google Chrome versions earlier than 155.0.8059.39 are impacted. The defect specifically affects the mobile version of Chrome on Android and does not apply to other operating systems or desktop Chrome releases.

The vulnerability is limited to local attacks, typically requiring social engineering to co‑install a malicious app on the user’s device. Because the attacker must first lure a user to install an app, the opportunity curve is lower than for remote exploits, and the EPSS score is < 1%. The CVSS score of 8.4 indicates high severity. The issue is not listed in the CISA KEV catalog; however, its medium severity rating suggests it is a moderate risk for users who frequently install third‑party apps. The available patch mitigates the flaw by restoring the missing authorization check, preventing local code execution.