The vulnerability arises from insufficient policy enforcement within the PreviewTab component of Google Chrome on Android. A remote attacker can craft a malicious HTML page that, when a user follows specific UI gestures, bypasses the browser’s same origin policy, enabling the attacker to access or manipulate data across origins and potentially compromising confidentiality and integrity. This type of weakness is characterized by improper access control.

Google Chrome for Android, all versions prior to 149.0.7827.53 are affected.

The CVSS assessment labels this issue as medium severity with a score of 6.5, and EPSS indicates a probability of less than 1%, with the vulnerability not yet listed in CISA KEV. Exploitation requires social engineering to persuade a user to perform particular gestures after visiting a malicious page, so while the attack vector is remote, it depends on user interaction, reducing the likelihood of widespread exploitation under current conditions.