The updated description reports a race condition in the Voice component of Google Chrome on Android that allows a local attacker with a co‑installed application to bypass system access restrictions and navigate to a privileged page within Chrome. This flaw, classified as CWE-367, arises from timing issues in voice data handling, enabling the attacker to execute code within the Chrome process. Based on the description, it is inferred that the attacker could potentially elevate privileges on the device.

Google Chrome on Android devices is affected, specifically any Chrome version prior to 156.0.8078.47. Google's Chrome stable channel for Android had the vulnerability; all older releases before that patch level are impacted.

The CVSS score of 8.8 marks this as high severity, while the EPSS score is under 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it requires a local attacker with a malicious co‑installed app, the likely attack vector is local, not remote. Successful exploitation would permit code execution from within Chrome and is inferred to possibly give the attacker higher privileges on the device.