An Android Autofill component in Google Chrome improperly enforces same‑origin policy, allowing a crafted web page to access data from another origin. This flaw can lead to unintended information disclosure if a malicious page is loaded in the victim’s browser, potentially exposing credentials, personal data, or other sensitive autofill entries, without requiring any local privileges. The weakness manifests as a policy enforcement bypass rather than code injection, categorised by the CWE‑200 class of information exposure vulnerabilities.

Google Chrome for Android versions prior to 149.0.7827.53. The vulnerability is fixed in the 149.0.7827.53 release family and later. Devices running these older Chrome builds on Android are susceptible.

The CVSS score is not publicly disclosed, and EPSS data is unavailable, so the baseline risk remains uncertain. No recognition in the CISA KEV catalog indicates no publicly known exploits yet, but the attack vector is a remote crafted HTML page delivered via the browser, implying an external attacker could exploit the flaw if a user visits a malicious site. Until a patch is applied, users remain at risk of cross‑origin data leakage.