The vulnerability permits an attacker who has already gained control of a renderer process to craft an HTML page that causes the WebView component to expose sensitive cross‑origin data. This results in an information‑disclosure breach, as leaked data was not intended to be accessed by the attacker. The weakness is an insufficient validation of untrusted input, reflected by the CWE‑20 and CWE‑79 identifiers. While the description labels the severity as Medium, the affected scope is limited to compromised renderer processes on Android devices running older Chrome versions.

Google Chrome for Android before version 151.0.7922.72 is affected. All Android installations using the older WebView component that integrate this particular Chrome rendering engine are vulnerable. Users of newer Chrome releases are not impacted.

The CVSS score is 4.3, placing the vulnerability in the Medium range. The EPSS score of less than 1% indicates a very low probability of widespread exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real‑world exploitation. Exploitation requires the attacker to have already compromised the renderer process, which is a non‑standard attack vector and reduces the likelihood of a successful remote data leakage. Nonetheless, once renderer compromise is achieved, the attacker can extract cross‑origin information without additional privileges.