The ContentCapture component of Google Chrome on Android contains an information disclosure flaw. Prior to version 156.0.8078.47, a local attacker could trigger this flaw by installing a co‑installed app that interacts with the browser content, allowing the attacker to read data that should remain private to the browser. The flaw is identified as CWE-200.

Devices running Google Chrome on Android with a version older than 156.0.8078.47 are affected. All Chrome installations on Android that use that build prior to the patch are vulnerable.

The CVSS score of 8.8 indicates a high confidentiality risk, while the EPSS score of < 1% signifies a low probability of exploitation. Additionally, the vulnerability is not listed in CISA KEV, reducing the likelihood of a publicly available exploit. Exploitation requires a co‑installed application with local privileges, which can be achieved when a user installs a malicious app that interacts with browser content.