The updated description confirms that the vulnerability involves an out‑of‑bounds read in the CustomTabs component of Google Chrome on Android, permitting local attackers to read Chrome’s memory and leak sensitive information via a co‑installed app. The flaw still does not grant code execution or denial of service, and remains a confidentiality‑only weakness, identified as CWE‑125 and CWE‑200.

Android installations of Google Chrome prior to version 156.0.8078.47 are affected. The issue also applies to any Android applications that use CustomTabs to display web content, as a malicious co‑installed app can leverage the flaw to read Chrome’s memory.

Chromium rates this issue as medium severity with a CVSS score of 6.5. The EPSS score is less than 1 %, indicating a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. Exploitation requires a malicious co‑installed app executed locally on the device; the attack vector is local. While exploitation remains unlikely, the potential to leak confidential data justifies prompt remediation.