Chrome on Android implements CustomTabs incorrectly, allowing a local attacker to craft an HTML page that causes Chrome to expose data from a different origin. The flaw is purely informational and does not provide code execution, privilege escalation, or denial of service. It enables a local user who can load a custom tab to read sensitive cross‑origin data that should remain isolated.

The vulnerability affects Google Chrome on Android versions prior to 149.0.7827.53, specifically the CustomTabs component. Devices running these unpatched builds are exposed; later releases include the fix.

Chromium labeled the issue as Low severity, but the CVSS score is 6.5, and the EPSS score is <1%, indicating a low likelihood of exploitation. Based on the description, exploitation requires local access on a device and the user must trigger a malicious CustomTab, making the likely attack vector a crafted HTML page opened within CustomTabs. The flaw is not listed in CISA’s KEV catalog. While the risk is limited, it is viable in environments where apps embed CustomTabs to display web content.