The vulnerability is an incorrect authorization check in the cookie handling logic of Google Chrome on Android. A malicious actor can craft an HTML page that, when accessed, causes the browser to treat a cookie as authorized, effectively bypassing the web origin policy. The result is that an attacker can access resources or perform actions that are normally blocked by the same‑origin restriction, potentially leading to the execution of code or disclosure of data inside the Chrome sandbox.

Affected systems include Google Chrome on Android, with all versions released prior to 156.0.8078.47. Any Android device running a vulnerable Chrome browser that is not updated to the patched release is at risk.

The CVSS score of 8.8 classifies the risk as high. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires only a user to open or view a crafted HTML page, which makes social engineering a viable vector for an attacker to trigger the policy bypass.