The flaw is an insufficient validation of untrusted input in the user interface of Google Chrome on Android. This is a CWE‑20 input validation weakness coupled with a CWE‑346 improper trust attribution. A local attacker can serve a crafted HTML page that, when opened by a victim, causes Chrome to read data from a different origin. The attacker can then exfiltrate that cross‑origin data, potentially revealing personal or confidential information. This vulnerability is a local data‑exfiltration risk that affects the confidentiality of information accessible in the browser context.

Google Chrome on Android devices running versions prior to 151.0.7922.72 are affected. Users of earlier Chrome releases on Android should verify their installed version and upgrade if necessary.

With a CVSS score of 7.5, the vulnerability is considered high severity, though the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, and no public exploits have been reported. Exploitation requires local access and the victim to navigate to or otherwise load the crafted HTML page, so the threat is confined to a local environment but still represents a significant privacy risk if discovered.