Incorrect authorization in Chrome's CustomTabs on Android, observed in configurations prior to version 156.0.8078.47, allowed a local attacker to obtain cross‑origin data via a co‑installed app. The vulnerability enables the attacker to bypass same‑origin restrictions and access information from other web origins.

Google Chrome running on Android devices, specifically those with versions before 156.0.8078.47, are affected.

The CVSS score of 8.8 indicates a high severity rating, while the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector involves a co‑installed app with incorrect authorization accessing cross‑origin data via the CustomTabs component. This data leakage primarily threatens confidentiality, with the risk of exposing sensitive information from other web origins but does not provide integrity or availability impacts.