This vulnerability stems from a deficient implementation in the WebView component of Google Chrome on Android. A crafted HTML page can cause the browser to execute code with higher privileges than intended, potentially allowing the attacker to gain system‑level access or compromise sensitive data. The weakness aligns with an improper access control flaw, enabling unauthorized privilege escalation.

Google Chrome for Android versions before 149.0.7827.53 are affected. This includes the bundled WebView component used by Android applications that embed web content. Systems running these versions without the latest security update remain vulnerable.

An attacker can trigger the flaw by loading or rendering a maliciously crafted web page; the vector is remote and requires no local user interaction beyond opening the page. The likely attack vector is a rendered web page, inferred from the mention of a crafted HTML page. The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% suggests that, while the vulnerability is severe, exploitation at this time is unlikely. It is not listed in the CISA KEV catalog, but the widespread use of Chrome on Android means the potential impact remains significant if an attacker can deliver the malicious payload.