An insufficient validation flaw (CWE-20) in the Android WebView component of Google Chrome allows a remote attacker to deliver a specially crafted HTML page that bypasses the same-origin policy after first compromising the renderer process. Because this policy is designed to prevent web pages from accessing content from other origins, the bypass could enable the attacker to read or manipulate data across origins, effectively breaking the browser’s security boundary. Chromium has marked the issue as medium severity.

Google Chrome on Android versions prior to 150.0.7871.47 are affected. Users running those builds are at risk of the same-origin policy bypass if a renderer process is compromised. Custom applications that embed the WebView and load untrusted content may also be susceptible, although this is not explicitly stated in the description and is inferred from the platform’s use of the WebView component.

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, reflecting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker who has already compromised the renderer process, who can then bypass same-origin policy through a crafted HTML page.