Insufficient policy enforcement in the Android Chrome WebView component allows a remote attacker to expose data from a different origin by serving a specially crafted HTML page. This flaw permits the retrieval of information that should be confined to its originating origin, compromising the confidentiality of the victim’s data. The weakness aligns with information‑exposure and access‑control concepts, corresponding to CWE‑200 and CWE‑285.

The vulnerability affects Google Chrome for Android versions up to but not including 149.0.7827.53. Android users running a Chrome build older than 149.0.7827.53 are exposed.

The CVE carries a medium severity rating and is not flagged in the CISA KEV catalog. EPSS information is unavailable, so the probability of exploitation cannot be quantified, but the vulnerability requires the attacker to deliver a malicious HTML page to the target device, typically via a site or hosted content that the device’s Chrome WebView will load. With no current exploit available in the wild, the risk remains primarily contingent on the attacker’s ability to serve such content to the victim.