Chrome for Android includes a missing‑authorization flaw in the Passwords component that allows an attacker who has already compromised the renderer process to read data across origins from a crafted HTML page. The vulnerability does not enable code execution or sandbox elevation; rather, it permits unauthorized access to user data that the browser ordinarily protects.

All users running Google Chrome on Android versions earlier than 156.0.8078.47 are affected. The flaw impacts Chrome installations bundled with the Android operating system and any browsers based on the same upstream code. Devices with newer Chrome releases are not impacted.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is <1%, suggesting a very low but nonzero likelihood of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector involves delivering a malicious HTML page—commonly via phishing or a compromised website—to a user whose browser session already has a renderer process compromise; this precondition makes widespread exploitation more difficult.