This vulnerability stems from a deficient implementation in the WebView component of Google Chrome on Android. A crafted HTML page can cause the browser to execute code with higher privileges than intended, potentially allowing the attacker to gain system-level access or compromise sensitive data. The weakness aligns with an improper access control flaw, enabling unauthorized privilege escalation.

Google Chrome for Android versions before 149.0.7827.53 are affected. This includes the bundled WebView component used by Android applications that embed web content. Systems running these versions without the latest security update remain vulnerable.

An attacker can trigger the flaw by loading or rendering a maliciously crafted web page; the vector is remote and requires no local user interaction beyond opening the page. While the formal CVSS score is not supplied, the description indicates low severity from Chromium, yet the impact of privilege escalation warrants caution. EPSS for this vulnerability is not available, and it is not listed in the CISA KEV catalog, but the potential for widespread exploitation remains high due to the common use of Chrome on Android.