Chrome on Android implements CustomTabs incorrectly, allowing a local attacker to craft an HTML page that causes Chrome to expose data from a different origin. The flaw is purely informational and does not provide code execution, privilege escalation, or denial of service. It enables a local user who can load a custom tab to read sensitive cross‐origin data that should remain isolated.

The vulnerability affects Google Chrome on Android versions prior to 149.0.7827.53, specifically the CustomTabs component. Devices running these unpatched builds are exposed; later releases include the fix.

Chromium labels the issue as low severity and no EPSS data is published, suggesting a small exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires local access on a device and the user must trigger a malicious CustomTab. While the risk is limited, it is viable in environments where apps embed CustomTabs to display web content.