An Android Autofill component in Google Chrome does not properly enforce same‑origin policy, allowing a crafted web page to read autofill entries stored by another origin. The flaw enables an attacker to obtain credentials, personal data, or other sensitive autofill entries without requiring any local privileges. The weakness is a policy enforcement bypass, a weakness type represented by CWE‑346.

Google Chrome for Android builds before 149.0.7827.53 are affected. The 149.0.7827.53 release family and later contain the fix, so devices running older Chrome versions on Android remain vulnerable.

The CVSS score is 4.3, and the EPSS score is <1%, implying a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, indicating no publicly known exploits at present. A likely attack vector is a remote crafted HTML page served to the victim’s browser, meaning an external attacker could cause the flaw to be triggered if the user visits a malicious site. Until Chrome is updated, users face a small but non‑negligible risk of cross‑origin data leakage.