A flaw in Chrome for Android before version 157.0.8103.38 allows an attacker to craft a malicious HTML page that, when opened on the device, bypasses built‑in permission checks and grants the attacker wider access to system resources. The vulnerability is identified as an authorization weakness that can lead to privilege escalation but does not provide arbitrary code execution. Chromium labels the issue as medium severity, indicating a noticeable threat when the exploit is successful.

The affected product is Google Chrome running on Android devices. Any installation of Chrome older than version 157.0.8103.38 is vulnerable. Devices with the stable Chrome channel prior to the mentioned build are at risk.

The CVSS metric is not reported, and the EPSS score is unavailable, so the probability of exploitation in the wild is uncertain. The lack of a KEV listing further suggests no widespread known exploits have been observed. The likely attack vector requires a crafted HTML page to be opened in Chrome, meaning the attacker needs a social‑engineering or phishing vector to lure the victim into loading the malicious content. Once the page is rendered, the incorrect authorization permits the victim’s browser to execute privileged actions that it would normally be denied, potentially allowing access to protected files or system settings. The risk level is moderate to high for environments where users have the ability to visit arbitrary sites without additional safeguards.