Technical impact
Insufficient policy enforcement in the Android Chrome WebView component allows a remote attacker to expose data from a different origin by serving a specially crafted HTML page. This flaw permits the retrieval of information that should be confined to its originating origin, compromising the confidentiality of the victim’s data. The weakness aligns with information‑exposure and access‑control concepts, corresponding to CWE-200, CWE-285 and CWE-346.
Affected Systems
The vulnerability affects Google Chrome for Android versions up to but not including 149.0.7827.53. Android users running a Chrome build older than 149.0.7827.53 are exposed.
Risk and Exploitability
The CVE has a CVSS score of 4.3, which is considered low severity, and is not listed in the CISA KEV catalog. EPSS score is <1%, indicating a very low probability of exploitation in the wild. Based on the description, the likely attack vector involves delivering a malicious HTML page that the device’s Chrome WebView will load, typically via a site or hosted content that the device’s WebView will render. With no current exploit available in the wild, the risk remains primarily contingent on the attacker’s ability to serve such content to the victim.
Debian DSA