Missing authorization in the Passwords component of Google Chrome on Android prior to 156.0.8078.47 enables a remote attacker, typically through social engineering, to obtain sensitive information via a crafted HTML page. The flaw arises from inadequate access controls around password data, permitting an attacker to read stored credentials or related secrets. This vulnerability compromises user confidentiality but does not provide code execution or direct system compromise.

Affected are users of Google Chrome on Android devices running any version prior to 156.0.8078.47. The issue impacts the Android variant of Chrome and does not apply to desktop or other operating systems.

The CVSS score of 8.8 signals high severity, though the EPSS score of less than 1% indicates exploitation is presently unlikely and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, mediated by a maliciously crafted HTML file accessed through the browser, requiring the victim to load the page or visit a site containing the exploit. Once the page is loaded, the attacker can read stored password information without additional privileges.