A missing‑authorization flaw in the Media component of Google Chrome for Android allows a remote attacker who has already compromised the renderer process to gather sensitive information by delivering a specially crafted HTML page. The bug arises from an insufficient check that permits the renderer to access data it should not see when parsing media content, effectively leaking user data. The vulnerability can expose confidential information but does not allow arbitrary code execution within the browser sandbox.

Google Chrome on Android versions earlier than 156.0.8078.47 are affected. The issue is tied to the Android operating system running the Chrome browser bundle; any device that has not upgraded past this build is vulnerable.

The CVSS score of 8.8 indicates high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation in the short term. The attack vector remains a crafted HTML page delivered over the network; the attacker must first get a foothold in the renderer process. Once that precondition is met, they can trigger the missing‑authorization check to read privileged media data. Because exploitation requires both a renderer compromise and a specially crafted page, active remote exploitation is unlikely without simultaneous additional infections or zero‑day exploits. Nevertheless, the high CVSS warrants swift remediation for all affected devices.