Race condition in Chrome's SiteIsolation component on Android, affecting versions before 156.0.8078.47, permits an attacker to obtain cross‑origin data via a crafted HTML page. This flaw allows the attacker to read data from another origin that the browser normally protects, effectively bypassing the same‑origin policy. The weakness is categorized as a race condition (CWE‑367).

The vulnerability affects Google Chrome for Android on versions prior to 156.0.8078.47. Any device running the affected build of Chrome on Android is susceptible when displaying a malicious HTML page. No other Chrome platforms are listed as impacted.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of < 1% suggests a low expected exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. No official workaround is available. The attack vector is inferred to be the remote delivery of a specially crafted HTML document that the user must load in the browser. Successful exploitation requires user interaction, making social engineering a likely prerequisite.