The vulnerability involves an information loss flaw in Chrome’s CustomTabs component for Android that predates version 156.0.8078.47. This flaw allows a remote attacker to potentially bypass the web origin policy by delivering a specially crafted HTML page, which could enable the attacker to read data originating from other web origins. The vulnerability is classified as CWE‑221 and is rated medium severity by Chromium, but the CVSS score indicates a high potential impact on data confidentiality.

Android devices running Google Chrome versions earlier than 156.0.8078.47 are vulnerable. Updates are propagated through the Google Play Store, so any device that has not applied the latest stable release remains at risk.

The CVSS score of 8.8 highlights a high severity level, while an EPSS score of less than 1% points to a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker hosting a crafted HTML page that, when accessed through a third‑party app using CustomTabs, can trigger the origin policy bypass. No arbitrary code execution is documented in the official description.