An inappropriate implementation in Chrome’s WebView component allowed an attacker to craft a malicious HTML page that could be rendered on Android devices running Chrome versions prior to 149.0.7827.155. By opening such a page, the attacker could elevate their privileges on the device, potentially gaining full control of the device or accessing restricted data. The weakness corresponds to CWE-269, a failure in privileged access management.

Google Chrome for Android, with affected releases below 149.0.7827.155. Users of any device running these versions are at risk, regardless of Android version, until Chrome is updated to the patched release.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% and the fact that the vulnerability is not listed in the CISA KEV catalog suggest exploitation is unlikely in the near term. The likely attack vector is a remote attacker delivering a crafted HTML page that the victim loads in Chrome, leading to privilege escalation. It requires the victim to open the malicious page, but the vulnerability is not restricted by user interaction beyond loading the page.