The CVE describes an improper input validation flaw in the History component of Google Chrome on Android versions older than 156.0.8078.47. By compromising the renderer process, a remote attacker can bypass system access restrictions and force a privileged page to load specially crafted network traffic, potentially executing arbitrary code with Chrome’s privileges.

All Android devices running Google Chrome versions prior to 156.0.8078.47 are affected. The risk applies regardless of other security settings if those older versions remain installed.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score, listed as <1%, indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalog. While a publicly documented exploit is not available, the described path—compromising the renderer process and delivering crafted network traffic—demonstrates that the vulnerability could lead to remote code execution with Chrome’s privileges. Consequently, the potential impact is high, and the likelihood of exploitation remains very low due to the EPSS <1%.