The vulnerability originates from insufficient validation of untrusted input in the WebView component of Google Chrome for Android. A renderer process that has already been compromised can serve a maliciously crafted HTML page that forces the browser to read data from a different web origin. The flaw is a classic CWE‑20 input validation weakness, and the effect is the leakage of cross‑origin data; it also involves a second weakness (CWE‑346) related to insecure handling of trusted input. This exposes sensitive information but does not grant the attacker arbitrary code execution or system control.

Google Chrome for Android installations prior to version 149.0.7827.53 are affected. All earlier releases share the same issue.

The CVSS score is 6.5, which corresponds to Medium severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first have a foothold within the renderer process, typically by exploiting another vulnerability. Once that condition is met, the attacker can read cross‑origin data, threatening confidentiality of information accessed by other sites. The overall risk is moderate given the prerequisite for the renderer compromise.