The vulnerability is an inappropriate UI implementation that lets a remote attacker craft an HTML page to access and disclose data that should be blocked by same‑origin policy. The defect allows the attacker to read cross‑origin data, leaking confidential information stored in the browser or underlying Android system. The exposure is limited to data that the user has accessed in that browser session; there is no arbitrary code execution or privilege escalation.

Google Chrome browsers on Android devices running any version prior to 149.0.7827.53 are affected. The issue is specific to the Android implementation of Chrome’s UI component and does not apply to Chrome on other operating systems.

The CVSS score of 6.5 is moderate, and the EPSS score is below 1%, indicating a low likelihood of current exploitation. The vulnerability is still not listed in CISA’s KEV catalog, so no widespread exploitation is documented. Attackers would need to host a malicious, crafted HTML page on a web server and convince a user to open it in the vulnerable browser. Because the flaw only leaks data with no execution requirement, the damage is confined to information confidentiality. Nonetheless, malicious actors could reuse the page to harvest data across domains if users visit the page.