The vulnerability is an inappropriate UI implementation that lets a remote attacker craft an HTML page to access and disclose data that should be blocked by same‑origin policy. The defect allows the attacker to read cross‑origin data, leaking confidential information stored in the browser or underlying Android system. The exposure is limited to data that the user has accessed in that browser session; there is no arbitrary code execution or privilege escalation.

Google Chrome browsers on Android devices running any version prior to 149.0.7827.53 are affected. The issue is specific to the Android implementation of Chrome’s UI component and does not apply to Chrome on other operating systems.

The CVSS score is not published and EPSS is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Attackers would need to place a malicious, crafted HTML page on a web server and convince a user to open it in the vulnerable browser. Because the flaw only leaks data and no execution is required, the damage is confined to information confidentiality. Nonetheless, malicious actors could reuse the page to harvest data across domains if users visit the page.