Missing authorization in the Core component of Google Chrome for Android releases older than 156.0.8078.47 creates a flaw that lets a remote attacker exploit a crafted HTML page to read cross‑origin data that the browser has accessed. This weakness is tied to CWE-862: Missing Authorization and results in potential leakage of sensitive information; the attack is delivered through a web page and could also enable broader attacks such as remote code execution.

All Google Chrome for Android versions prior to 156.0.8078.47 running on any Android device are affected. Every user who has installed one of these releases, regardless of device brand, is vulnerable.

The CVSS base score of 9.6 signals a severe threat that can compromise confidentiality and may affect integrity if an attacker injects malicious payloads. The EPSS score of < 1% indicates that, at present, exploitation attempts are relatively rare. It is not listed in the CISA KEV catalog. The likely attack vector is a social‑engineering scenario where an attacker lures the user into opening a crafted HTML file in Chrome. Once opened, the missing authorization check permits reading arbitrary cross‑origin data. Exploitation requires the user to grant Chrome permission to access the local file and that the user has visited or loaded content that meets the cross‑origin conditions.