The vulnerability originates from insufficient validation of untrusted input in the WebView component of Google Chrome for Android. A renderer process that has already been compromised can serve a maliciously crafted HTML page that forces the browser to read data from a different web origin. The flaw is a classic CWE‑20 input validation weakness, and the effect is the leakage of cross‑origin data. This exposes sensitive information but does not grant the attacker arbitrary code execution or system control.

Google Chrome for Android installations prior to version 149.0.7827.53 are affected. All earlier releases share the same issue.

Chromium rates the defect as Medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has a foothold in the renderer process, which typically results from another vulnerability. Once that condition is met, the attacker can read cross‑origin data, threatening confidentiality of information accessed by other sites. The overall risk is moderate given the prerequisite for the renderer compromise.