Improper input validation in the Omnibox component of Google Chrome on Android allowed an attacker to craft a malicious HTML page that, when visited, could bypass the browser’s web origin policy. This flaw enabled a remote attacker to potentially read or modify content from other origins that the user was authenticated to, thereby exposing confidential information or enabling further malicious actions. The flaw is identified as CWE‑20, indicating an input validation weakness. The Chromium security team rated the issue as High severity, reflecting the potential impact on user data and privacy.

The vulnerability affects users of Google Chrome on Android using any version prior to 155.0.8059.39. No specific patch versions are listed, but any Android installation of Chrome before this release is susceptible.

The exploit requires social engineering; an attacker must persuade a user to visit a crafted page for the bypass to occur, implying user interaction. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.4 classifies it as medium severity, signifying a moderate risk if exploited. The cross-origin policy violation can lead to data leakage or unauthorized actions. No publicly documented zero‑day exploit exists as of the release note.