An insufficient policy enforcement in the CustomTabs feature of Google Chrome on Android prior to version 149.0.7827.53 allows a remote attacker to craft an HTML page that causes the browser to read cross‑origin data. The attacker can then exfiltrate that information, leading to a confidentiality breach. The issue is categorized as low severity by Chromium.

Affected systems are devices running Google Chrome for Android before build 149.0.7827.53, including all stable‑channel releases below that version as well as any beta or dev builds that have not yet applied the fix.

No EPSS score is available and the vulnerability is not in the CISA KEV catalog, suggesting a limited exploitation window. The exploit requires a victim to open a malicious CustomTabs page, implying user interaction. Because it merely leaks data, the risk remains low, but applications that handle sensitive information should be reviewed. The CVSS is not specified, but the low Chromium severity indicates modest impact.