A missing authorization check in the WebView component of Google Chrome on Android allows a compromised renderer process to read sensitive information through a crafted HTML page, exposing user data without proper controls. The flaw can lead to confidential data leakage if an attacker can load malicious content within the browser environment. It represents an information disclosure vulnerability tied to improper authorization controls, identified as CWE-862.

Google Chrome for Android versions earlier than 157.0.8103.38 are affected. Any device running a vulnerable build and allowing untrusted HTML content in a WebView may be susceptible until the issue is patched by updating to the latest stable release.

The vulnerability carries a medium severity indication from Chromium, and its exploitation requires that an attacker already has control over the renderer process or can trick the user into loading malicious content. EPSS data is not available and the issue is not listed in CISA KEV. Attack feasibility is limited to environments where untrusted WebView inputs are processed, but once the condition is met, the attacker can read protected data. The lack of official KEV listing means no widespread exploitation has been reported, though the potential impact remains significant for affected devices.